CISA Flags Actively Exploited Cisco BroadWorks XXE Flaw
Summary
CISA added Cisco BroadWorks flaw CVE-2026-20320 to its KEV Catalog and urged prompt patching. Malbear Labs separately reported exploitation targeting a European telecom provider and 13 organizations using its infrastructure.
Key points
- CVE-2026-20320 is an unauthenticated XXE flaw in the Cisco BroadWorks Open Client Interface XML parser that can expose sensitive configuration information.
- Cisco said the flaw could be exploited through crafted XML messages sent to the OCI-P service and patched it in August.
- CISA flagged the vulnerability as actively exploited and added it to its Known Exploited Vulnerabilities Catalog.
- CISA directed federal civilian agencies to secure affected systems by November 24 and urged other organizations to prioritize remediation.
- Malbear Labs reported that a Chinese-speaking threat actor used the flaw against a European telecom provider and 13 organizations using its data centers and cloud infrastructure.
- Malbear Labs said the activity exposed private keys and SSL credentials; these findings are attributed to the firm, not independently confirmed in the article.
Article Details
- Vulnerability Types
- XML External Entity (XXE) vulnerability caused by improper restriction of external entity references
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1005 · Data from Local SystemMalbear Labs reported that the attack read arbitrary files from the BroadWorks server and recovered configuration information and private keys.T1190 · Exploit Public-Facing ApplicationAttackers reportedly exploited the unauthenticated remote XXE vulnerability in the BroadWorks OCI XML parser by sending a crafted XML request.T1552.004 · Private KeysMalbear Labs reported recovery of the system identity private key and three additional private keys from the compromised XSP host.
CVE
Vendors
Products
Cisco BroadWorksCISA flags Cisco BroadWorks flaw as actively exploited in attacksDeepseek Flashthe weekend that a Chinese-speaking threat actor has exploited the flaw with the help of a jailbroken DeepSeek Flash artificial intelligence model in attacks targeting a European telecommunications provider and