The US Cybersecurity and Infrastructure Security Agency has marked a high-severity Cisco BroadWorks vulnerability as actively exploited in attacks. Cisco BroadWorks is a cloud unified communications platform used by telecom carriers and managed service providers to offer branded cloud PBX, voice, and collaboration services to business customers.
CISA’s new warning centers on CVE-2026-20320, which stems from improper restriction of an XML External Entity reference weakness in the Open Client Interface XML Parser. Cisco said in August that the flaw exists because XML entries are parsed incorrectly when external entity resolution is allowed by default, and that a crafted XML message sent to the Open Client Interface – Provisioning service can be used to exploit it.
CISA response and federal deadline
CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog on Tuesday and told Federal Civilian Executive Branch agencies to secure affected systems within two weeks, by November 24, under Binding Operational Directive 26-04. The agency also urged security teams outside the federal government to make the vulnerability a priority and follow risk-based vulnerability management for KEV Catalog entries.
CISA said these vulnerabilities are a frequent attack path for malicious cyber actors and create significant risk for the federal enterprise. It repeated that BOD 26-04 applies only to FCEB agencies, while still encouraging all organizations to focus on remediation of KEV Catalog flaws.
Activity seen in targeted attacks
CISA did not give more details about real-world exploitation of CVE-2026-20320. Over the weekend, however, Malbear Labs said a Chinese-speaking threat actor used a jailbroken DeepSeek Flash artificial intelligence model in attacks against a European telecommunications provider and 13 organizations using its data centers and cloud infrastructure.
The campaign focused on the telecom provider’s BroadWorks XSP, also known as the eXtended Services Platform. Malbear Labs said the BroadWorks Provisioning Server, which stores subscriber configuration for all users, was also exposed through an unauthenticated directory listing.
Malbear Labs said a crafted OCI request to port 2208 let the attacker use the XXE weakness in the BroadWorks OCI XML parser to read arbitrary files from the server filesystem without prior authentication. From the XSP host, the actor reportedly recovered the system identity private key, three SSL credential sets, and three additional private keys with certificate matches confirmed.
The company said the system identity key is used by BroadWorks to authenticate between its own components, and that possession of it allows impersonation of the XSP in inter-component communication. Since November 2021, CISA has added 103 Cisco vulnerabilities to its actively exploited list, and seven of those have also been abused by ransomware gangs.
Licensed under CC BY-ND 4.0 International