Summary
- CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalogue on 10 November.
- The flaw can allow unauthenticated remote attackers to read sensitive configuration information from affected BroadWorks systems.
- Cisco has issued security updates, with no available workaround fully addressing the weakness.
Telecommunications operators and managed service providers face increased security risk after US authorities confirmed active exploitation of a Cisco BroadWorks vulnerability that can expose sensitive configuration information without authentication.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20320 to its Known Exploited Vulnerabilities catalogue on 10 November, establishing that the weakness has been used in real-world attacks.
The vulnerability affects Cisco BroadWorks, a communications platform used by service providers to deliver hosted enterprise calling and related telecommunications services.
Cisco originally disclosed the issue on 19 August 2026 and assigned it a CVSS 3.1 severity score of 7.5.
The new CISA listing changes the operational assessment from a disclosed technical weakness to one associated with confirmed exploitation, increasing the urgency of applying available security updates.
XML processing exposes configuration files
The flaw involves improper handling of XML external entity references within the BroadWorks Open Client Interface parser.
XML is commonly used to structure and exchange information between software components. External entities allow a document to refer to resources outside its own contents, creating an exposure when software fails to restrict how those references are processed.
Under affected conditions, a crafted request to the BroadWorks provisioning service may cause information to be retrieved from files that should not be accessible to an unauthorised remote user.
The issue is classified as an XML external entity vulnerability, or XXE, and can permit disclosure of sensitive configuration information with the privileges available to the service.
Cisco does not describe CVE-2026-20320 as providing arbitrary remote code execution or complete administrative control by itself. Those outcomes should not be inferred from the fact of confirmed exploitation.
Shared communications platforms concentrate responsibility
BroadWorks may be operated by telecommunications providers supporting multiple business customers, rather than deployed exclusively within one organisation’s internal network.
That creates different operational dependencies from those associated with an ordinary desktop application. A provider’s communications systems may hold configuration information relevant to services used by several customers.
An information disclosure flaw in a central provisioning component can therefore raise questions about the scope of access across the operated environment, depending on its architecture and the permissions of the affected process.
However, CISA’s listing does not establish that numerous customers have suffered data exposure, or that every affected installation has been compromised.
The public information does not identify the number of attacks, the organisations involved, or the geographic distribution of exploitation.
Confirmed exploitation changes patch priorities
CISA’s Known Exploited Vulnerabilities catalogue is intended to identify vulnerabilities for which the agency has evidence of actual exploitation.
Inclusion is therefore distinct from a risk assessment based only on vulnerability severity or the availability of technical details.
An issue rated high rather than critical may still require urgent attention when attackers have already demonstrated that exploitation is possible, especially where the affected service is reachable from untrusted networks.
The catalogue assigns 24 November 2026 as the remediation deadline for the relevant US federal organisations.
That date is not a universal statutory deadline for British or European service providers. The vulnerability and its technical consequences nevertheless apply to affected deployments regardless of geography.
The listing does not establish involvement in ransomware attacks or identify a named threat actor.
Vendor updates provide the required correction
Cisco has issued fixed software releases and says there is no workaround that fully addresses the vulnerability.
Operators need to identify their BroadWorks versions, review the affected-service configuration, and apply the appropriate corrected release.
Because BroadWorks supports live communications services, updates may require coordinated maintenance and confirmation that calling and provisioning functions operate correctly afterwards.
Restricting access to provisioning interfaces and monitoring for suspicious requests can reduce unnecessary exposure while remediation is undertaken, but cannot replace installing the vendor’s fix.
Where affected systems were exposed, administrators may also need to assess available logs and the sensitivity of configuration files accessible to the service.
Cisco’s official security advisory identifies the relevant versions and corrective releases.
The newly confirmed exploitation reinforces the importance of revisiting previously disclosed weaknesses as fresh evidence emerges, especially in shared communications infrastructure used by multiple organisations.
