An unauthenticated remote attacker may read sensitive configuration information from an affected system.Cisco assigns a CVSS 3.1 score of 7.5. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, establishing that exploitation has occurred in the wild.
What it allows
How Does CVE-2026-20320 Expose BroadWorks Information?
The flaw is in the Open Client Interface XML parser. External entity resolution is allowed by default, so the parser can improperly process an attacker-controlled XML entry.
An unauthenticated remote attacker can send a crafted XML message to the provisioning service. If exploitation succeeds, the attacker can view sensitive filesystem content with the privileges of the Cisco BroadWorks user.
The published impact is confidentiality loss. Cisco's CVSS vector records high confidentiality impact, with no integrity or availability impact. This distinction matters because the advisory does not describe remote code execution or service disruption.
Cisco said on August 19 that it knew of no malicious use. CISA's November 10 KEV listing supersedes that earlier status and confirms exploitation in the wild.
Brandefense Blackhole recorded six posts mentioning CVE-2026-20320 during the 90 days ending November 11, 2026. Five appeared on Telegram and one on a forum. These counts show discussion, not attribution or proof of additional incidents.
Who is affected
Which Cisco BroadWorks Releases Are Affected?
The flaw affects BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform when they run a vulnerable release. Cisco says exposure applies regardless of device configuration.
For all four product lines, releases earlier than RI.2026.07 are affected. RI.2026.07 is the first fixed release. For Application Delivery Platform, Cisco specifies the affected Open Client Server and OCIOverSoap components.
Cisco lists no workaround. Its advisory recommends upgrading to the appropriate fixed release and confirms that only the products in its vulnerable-products section are known to be affected.
Timeline
- 2026-08-19
Cisco published its advisory and fixed releases. At publication, Cisco PSIRT said it was unaware of malicious use.
- 2026-11-10
CISA added CVE-2026-20320 to the Known Exploited Vulnerabilities catalog and set a November 24 remediation due date for covered federal agencies.
What to do
-
Upgrade to a fixed release
Move affected Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform deployments to RI.2026.07 or a later supported release.
-
Prioritize exposed systems
Inventory affected BroadWorks roles and identify provisioning interfaces reachable from untrusted networks. CISA directs organizations to evaluate each asset's internet exposure.
-
Meet the KEV remediation window
US federal civilian agencies should follow the CISA due date of November 24, 2026. Other organizations can use that deadline as a risk-based prioritization signal.
-
Review access to sensitive files
Brandefense recommends reviewing provisioning-service activity and filesystem access by the BroadWorks user for anomalies. Preserve relevant records for investigation.
-
Do not rely on a workaround
Cisco states that no workaround addresses this vulnerability. Confirm the running release after maintenance instead of treating a configuration change as remediation.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-20320?
It is an unauthenticated XML external entity vulnerability in the Cisco BroadWorks Open Client Interface XML parser. It may expose sensitive filesystem information.
Is CVE-2026-20320 actively exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on November 10, 2026. Cisco's August advisory had reported no known malicious use at that earlier time.
Which Cisco BroadWorks releases fix CVE-2026-20320?
Cisco identifies RI.2026.07 as the first fixed release for the four affected BroadWorks product lines. Earlier releases are affected.
Is there a workaround for CVE-2026-20320?
No. Cisco states that no workaround addresses the vulnerability and recommends upgrading to a fixed software release.
