BLOG
At a glance
- CVE-2026-20320 affects Cisco BroadWorks and has been added to CISA KEV.
- An unauthenticated remote attacker could read sensitive files through the OCI-P service.
- Versions before RI.2026.07 are affected across four listed BroadWorks products.
- Cisco recommends upgrading to RI.2026.07; no temporary workaround is currently available.
Cisco BroadWorks CVE-2026-20320 added to CISA KEV: upgrade affected systems
Cisco says CVE-2026-20320 in BroadWorks could let an unauthenticated remote attacker read sensitive files. The flaw was added to CISA KEV; Cisco recommends upgrading affected branches to RI.2026.07 as soon as possible.
In this article
Cisco PSIRT has published information about vulnerability CVE-2026-20320 in Cisco BroadWorks. The vulnerability could enable remote reading of sensitive files and has been added to CISA KEV.
Overview and technical details
Cisco BroadWorks is a platform for voice and communications services; OCI-P processes provisioning messages. The vulnerability concerns how the OCI XML Parser resolves external entities and parses XML.
| Field | Details |
|---|---|
| Vulnerability | CVE-2026-20320 |
| CWE | CWE-611 |
| CVSS | CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X) |
| KEV status | Added to CISA KEV in November 2026 |
Affected systems
Cisco identifies versions before RI.2026.07 of the products below as affected. The corresponding fixed release is RI.2026.07.
| Product | Affected versions | Fixed version |
|---|---|---|
| BroadWorks Application Delivery Platform (OCS and OCIOverSoap) | Versions before RI.2026.07 | RI.2026.07 |
| BroadWorks Application Server | Versions before RI.2026.07 | RI.2026.07 |
| BroadWorks Profile Server | Versions before RI.2026.07 | RI.2026.07 |
| BroadWorks Xtended Services Platform | Versions before RI.2026.07 | RI.2026.07 |
Mechanism and impact
The OCI XML Parser allows external entity resolution by default and parses XML incorrectly. An unauthenticated remote attacker could send crafted XML to the OCI-P service and read sensitive files on the system with the privileges of the Cisco BroadWorks user.
The described impact is file reading; the source does not confirm data modification or service disruption.
Exploitation status
CVE-2026-20320 was added to CISA KEV in November 2026. KEV status is a basis for prioritizing remediation under Cisco's recommendation; the source does not confirm a specific ongoing attack.
Remediation and mitigation
- Prioritize upgrading affected BroadWorks systems to the fixed release, RI.2026.07.
- Cisco confirms that no temporary workaround is currently available.
References
Related articles
CVE-2026-123039 exploited on Check Point products: prioritize remediation by November 16
CISA added CVE-2026-123039 to KEV after confirming active exploitation of a permissions flaw in multiple Check Point products running Gaia OS. An authenticated local user may run commands as root; assess exposure, conduct forensic triage and follow CISA guidance by the November 16, 2026 KEV…
UnrealIRCd: CISA confirms active exploitation of CVE-2026-114713
CISA confirms CVE-2026-114713 in UnrealIRCd is being exploited in the wild. A user on a network with at least two linked servers can inject server-to-server commands executed with server privileges. Prioritize mitigations under CISA guidance before the KEV deadline of 2026-11-16.
Microsoft patches 1,093 November 2026 vulnerabilities: prioritize Outlook zero-day
Microsoft’s November 2026 updates address 1,093 vulnerabilities. Outlook spoofing flaw CVE-2026-124194 is a zero-day under active exploitation. Prioritize updates on systems using Outlook and back up important data before patching Windows.
Chromium: CISA adds CVE-2026-125350 to KEV and urges prioritized remediation
CISA added CVE-2026-125350, a use-after-free in Chromium's XML component, to KEV and confirmed it is being exploited in the wild. Chrome, Edge, and Opera may be affected; check versions, update per vendor guidance, and note CISA's 2026-11-24 remediation deadline.