CVE-2026-20320
Published 2026-08-19 · Updated 2026-11-10 · Source psirt@cisco.com
Summary
CVE-2026-20320 is a high-severity (CVSS 7.5) vulnerability in Cisco BroadWorks. CISA added it to the Known Exploited Vulnerabilities catalog on November 10, 2026, which means exploitation in the wild has been confirmed; US federal agencies must remediate it by November 24, 2026. CISA does not currently list it as used in ransomware campaigns. Cisco has 102 vulnerabilities in the KEV catalog, 7 of them linked to ransomware.
All 102 known-exploited Cisco vulnerabilities →Description
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Cisco — BroadWorks
Name: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Date added: 2026-11-10 · Due: 2026-11-24
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.