CVE-2026-20320: Cisco BroadWorks XXE Vulnerability

# CVE-2026-20320: Cisco BroadWorks XXE Vulnerability

https://gcdradar.vercel.app/incidents/cve-2026-20320-cisco-broadworks-xxe-vulnerability · AIR-2026-1879 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Exploited in the wild as confirmed by CISA KEV.
- Fix status: Partly patched
- First reported: 2026-11-10
- AI role: No AI role
- Products: Cisco BroadWorks
- CVE ids: CVE-2026-20320
- CVSS: 7.5

## Summary

An improper restriction of XML external entity reference vulnerability in Cisco BroadWorks allows unauthenticated attackers to read sensitive configuration information. CISA confirmed exploitation in the wild and added the flaw to its KEV catalog.

## What to do

Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.

## Latest updates

- 2026-11-10: CVE-2026-20320: Cisco BroadWorks — Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20320)

## Sources

- 2026-11-10 CISA: CVE-2026-20320: Cisco BroadWorks — Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20320
- 2026-11-11 The Hacker News: Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
- 2026-11-11 SecurityWeek: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities https://securityweek.com/threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities
- 2026-11-11 BleepingComputer: CISA flags Cisco BroadWorks flaw as actively exploited in attacks https://bleepingcomputer.com/news/security/cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.