Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The US Cybersecurity and Infrastructure Security Agency has added two security flaws to its Known Exploited Vulnerabilities catalog, indicating they are being actively exploited. The vulnerabilities affect Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder, despite available patches. One of the flaws, identified as CVE-2026-20320, has a CVSS score of 7.5 and involves an improper restriction of XML external entity. This vulnerability is being exploited by attackers, according to CISA. The agency's move to add these flaws to the KEV catalog suggests that exploitation is ongoing. Active exploitation of these vulnerabilities poses a risk to unpatched systems.