CVE-2026-20320

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.50%
EPSS Percentile: 41.61%
CISA KEV: Not listed

Description

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 20-Aug-2026 00:18
Last Modified: 20-Aug-2026 20:01
EPSS Date: 2026-10-23
CWE: CWE-611

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

References

[email protected]

Last enrichment sync: 02-Nov-2026 13:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Tracked as CVE-2026-20320, it existed because external entity resolution was allowed by default, allowing attackers to send crafted XML messages and view sensitive files with BroadWorks user privileges. Cisco Patches 15 Vulnerabilities Across Crosswork, Secure Workload and Other Products

CVE (9)

Vendors (1)

Products (12)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.