CVE-2026-20320 Cisco BroadWorks Vulnerability: Patch Now

CVE-2026-20320 lets an unauthenticated attacker over the network read sensitive files from a Cisco BroadWorks server. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-10, so treat it as an active risk. The fix is RI.2026.07.

What happened

Cisco published its advisory on 2026-08-19. The bug sits in the Open Client Interface (OCI) XML parser. External entity resolution is allowed by default, so XML is parsed unsafely. The weakness is CWE-611.

An attacker sends a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service. A successful attack lets them view files on the filesystem with the privileges of the Cisco BroadWorks user. Cisco titles the issue an out-of-band blind XML external entity injection, per its advisory.

Who is affected

The flaw affects these products on a vulnerable release, regardless of device configuration:

• BroadWorks Application Delivery Platform

• BroadWorks Application Server

• BroadWorks Profile Server

• BroadWorks Xtended Services Platform

The advisory adds a footnote to the Application Delivery Platform row that mentions Open Client Server (OCS) and OCIOverSoap. Read that row in the Cisco advisory before you plan that upgrade.

How serious it is and whether it is exploited

The CVSS 3.1 base score is 7.5 (High). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. That means network reachable, low complexity, no login, no user interaction, and high impact on confidentiality only.

The score does not cover what an attacker does with the files. Configuration files often hold hostnames, service accounts or keys. Stolen secrets can lead to deeper access, so plan a credential review (see the steps below).

On exploitation, the picture changed after the advisory. Cisco's advisory said its PSIRT knew of no malicious use when it was published. CISA has since added the CVE to KEV, and the NVD record lists a third-party exploit reference. Ransomware use is listed as unknown in the CISA catalog entry.

US federal agencies must act by 2026-11-24 under CISA's BOD 26-04, *Prioritizing Security Updates Based on Risk*. The required action also includes CISA's "Forensics Triage Requirements", so triage is part of the job, not just patching. CISA tells stakeholders to evaluate each asset's internet exposure.

What to do now

Cisco says there are no workarounds that address this flaw. Patching is the only real fix.

1. Inventory. List every Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform node. Record each release.

2. Cut exposure first on internet-facing nodes, before you patch. Allow the OCI-P port only from known provisioning hosts. This reduces risk but does not fix the bug.

3. Upgrade anything earlier than RI.2026.07 to RI.2026.07 or later.

4. Hunt for abuse using the checks below, before and after patching. Follow CISA's "Forensics Triage Requirements" if you are a federal stakeholder, and preserve logs before you change anything.

5. Rotate secrets that live in readable configuration files if you see signs of probing. This is a precaution, since the flaw exposes file contents.

6. If you cannot patch or mitigate, CISA's guidance says to discontinue use of the product.

Use this table to decide the order of work:

Commands to check exposure

These are generic Linux checks. Replace each placeholder with values from your own environment. Find your OCI-P port in your BroadWorks configuration.

List listening services on the node:

sudo ss -tlnp

Test from an outside host whether OCI-P is reachable:

nmap -Pn -p <OCI-P_PORT> <broadworks-host>

Search logs for XML entity markers, which probing often leaves behind:

sudo grep -rIn -E '<!DOCTYPE|<!ENTITY|SYSTEM +"(file|http|ftp):' <log_directory>

This only finds markers if your logs record request bodies. No matches is not proof that nobody probed the server.

The attack is out-of-band, so also review outbound connections from the server to hosts you do not recognize:

sudo ss -tnp state established

As a temporary measure, limit the OCI-P port to your provisioning hosts. Each -I INPUT 1 puts a rule at the top of the chain, so run the DROP first and the ACCEPT second. The ACCEPT then ends up above the DROP:

sudo iptables -I INPUT 1 -p tcp --dport <OCI-P_PORT> -j DROP
sudo iptables -I INPUT 1 -p tcp --dport <OCI-P_PORT> -s <provisioning_host_ip> -j ACCEPT

These rules do not survive a reboot unless you save them with your distribution's method. Test firewall changes in a maintenance window. A wrong rule can cut off legitimate provisioning.

What learners can take from it

This bug is a classic case of unsafe XML parsing, which is why XXE keeps showing up in security exam objectives. It also shows why asset inventory and exposure checks come first in any response. If you want to practice triage, log hunting and vulnerability prioritization, the CompTIA CySA+ CS0-003 voucher ($224.99) fits that skill set. Our cybersecurity certification page lists other paths.

Vouchers are delivered by email within 12 hours.

Sources

• NVD CVE-2026-20320

• Cisco Security Advisory: BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-20320