CiscoAnalysisCISA adds Cisco BroadWorks XML external entity flaw to KEV catalog amid active attacks
What happened.CISA added an out-of-band blind XML external entity injection vulnerability in Cisco BroadWorks to its Known Exploited Vulnerabilities catalog.
Why it matters.Cisco BroadWorks provides session control backbones for telecommunications carriers and large enterprise phone networks. When unauthenticated XML payloads force servers to leak configuration files, threat actors intercept carrier communications. Telecommunications engineers must apply Cisco BroadWorks maintenance patches immediately and restrict management port access.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-20320, the defect resides in the Open Client Interface XML parser of Cisco BroadWorks application delivery platforms.
- Exploit method: Unauthenticated remote attackers send crafted XML messages to network ports, forcing the server to read files and open outbound channels.
- Data exfiltration: Threat actors leverage out-of-band responses to extract sensitive configuration data, cryptographic tokens, and subscriber records.
- Exploitation confirmation: CISA confirmed active in-the-wild exploitation against telecommunications providers, setting a federal remediation deadline under BOD 26-04.
- Remediation releases: Cisco released software maintenance fixes across BroadWorks Release 23.0 and Release 24.0, noting access control lists can limit port exposure.