The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the exploitation of a high-severity vulnerability in Cisco BroadWorks, tracked as CVE-2026-20320. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.
The security flaw arises from an improper restriction of XML External Entity (XXE) reference in the Open Client Interface (OCI) XML Parser. This allows unauthenticated, remote attackers to read sensitive configuration information by sending maliciously crafted XML messages to vulnerable systems.
CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies secure their systems against this vulnerability by November 24. The agency has noted that 103 Cisco vulnerabilities have been added to its list of actively exploited flaws since November 2021.
Malbear Labs reported that a Chinese-speaking threat actor exploited this flaw, targeting a European telecommunications provider's BroadWorks XSP (eXtended Services Platform).
The exploitation allowed the attacker to recover sensitive keys and credentials from the system.