What happened
On August 19, 2026, Cisco published a security advisory about a flaw in Cisco BroadWorks, tracked as CVE-2026-20320. BroadWorks is the software that telecom operators and service providers use to run cloud telephony, hosted phone systems and other communication services for their customers.
The bug sits in the component that processes XML messages arriving through the Open Client Interface (OCI). An attacker can exploit it over the network, without logging in, to read sensitive configuration files on the server. Cisco has released the fixed release RI.2026.07 and says there is no workaround.
When the advisory came out, Cisco was not aware of any malicious use. That changed on November 10, 2026, when the US agency CISA added the flaw to its catalog of actively exploited vulnerabilities (KEV). Since the same day, the EU vulnerability database EUVD run by ENISA also lists it as exploited (EUVD-2026-62586). According to The Hacker News, there are no details yet on how the attacks work or who is behind them.
Why it is dangerous
This is an XXE vulnerability (XML External Entity, category CWE-611). XML lets a document refer to so-called external entities, meaning content stored somewhere else, such as a file on disk. Picture a mailroom clerk who receives a letter saying “insert the contents of the document in drawer 5 here” and simply does it without thinking. According to Cisco, the BroadWorks XML parser allowed this kind of insertion by default.
An attacker can send a specially crafted XML message to the OCI-P service (Open Client Interface Provisioning). No credentials are needed and the attack works over the network. The result is the ability to read files on the server with the privileges of the user BroadWorks runs as. Cisco’s advisory title calls it an “out-of-band blind” variant: the server does not show the data directly in its reply, but it can be tricked into sending it somewhere else.
On its own, the flaw does not let anyone change data or take the server down. Configuration files, however, often contain passwords, keys or credentials for other systems. If an attacker got hold of them, they could use them to move further into the network.
Cisco rated the flaw CVSS 7.5 out of 10 under CVSS 3.1, which counts as high severity. CVSS is an international scale that rates how easy a flaw is to exploit and how much damage it can do. The CISA KEV catalog lists flaws for which the US agency has evidence of real-world exploitation. US federal agencies must fix this one by November 24, 2026.
EPSS estimates the probability that a flaw will be exploited in the next 30 days. As of November 10, 2026, it stood at 0.4%. A low EPSS is no reason to relax here, because the KEV listing confirms the flaw is already being exploited.
Who is affected
According to Cisco, the flaw affects the following products if they run a BroadWorks release earlier than RI.2026.07, regardless of how they are configured:
- BroadWorks Application Delivery Platform (specifically the Open Client Server and OCIOverSoap components)
- BroadWorks Application Server
- BroadWorks Profile Server
- BroadWorks Xtended Services Platform
Cisco states that only the products on this list are known to be affected. BroadWorks is typically run by telecom operators, hosted telephony and cloud PBX providers, and large organizations with their own communications infrastructure.
Most small and mid-sized businesses do not run BroadWorks themselves, but they may use it indirectly through a cloud phone service from their operator. In that case there is nothing for you to update. Do ask your provider whether their service runs on BroadWorks and whether they have already applied the fix.
How to check if you are affected
On BroadWorks servers, you can see the installed version with a command that only displays information and changes nothing:
bwshowverIf the output shows a release earlier than RI.2026.07, the server is vulnerable. Next, find out where the OCI-P service can be reached from. This command lists the ports the server is listening on:
ss -tlnpCompare the output with the OCI-P port in your configuration, then check on your firewall whether the service is reachable from the internet or only from internal systems.
How to fix it
The only fix Cisco lists is upgrading all four affected products to release RI.2026.07 or later. According to the vendor, there is no workaround. Proceed as follows:
- List all your BroadWorks servers and their current releases.
- Start with servers where the OCI-P service is reachable from the internet or from partner networks.
- Back up your configuration before upgrading. Cisco advises checking that the device has enough memory and that the new release supports your current configuration.
- Download the fixed software through Cisco Software Download. If you have no service contract, contact Cisco TAC with the product serial number and a link to advisory cisco-sa-bworks-xxe-uwUd7CEt, in which case the upgrade is free.
- Apply the upgrade following Cisco’s documentation and confirm the new release with
bwshowver.
Until the upgrade is in place, restrict access to the OCI-P service on your firewall to the IP addresses that genuinely need it, and block unnecessary outbound connections from BroadWorks servers. This is not a Cisco recommendation but standard good practice. It lowers the risk but does not replace the upgrade.
CISA has given US federal agencies until November 24, 2026. Since the flaw is already being exploited, that is a sensible deadline for everyone else too.
What if you may already be compromised
Cisco, CISA and The Hacker News have not yet published specific indicators of compromise. If a vulnerable server was reachable from untrusted networks, assume an attacker may have read its configuration files. Look at:
- OCI-P service logs: requests from unknown IP addresses, unusual XML messages or parser error messages,
- firewall logs: unexpected outbound connections or DNS lookups from BroadWorks servers to unknown addresses, since with an “out-of-band” variant this is exactly where data could leave,
- logins to the admin interface and other systems from unfamiliar locations or at unusual times,
- new or unknown administrator accounts.
If you find anything suspicious, or the server was exposed to the internet for a long time, change the passwords, keys and certificates stored in its configuration after upgrading. For this flaw, CISA also points to its forensic triage requirements. If you suspect a leak, bring in an incident response specialist or Cisco TAC, and keep all logs until then.