This is an explainer for a vulnerability in the provisioning interface of Cisco BroadWorks (a call-service platform used by telecom carriers and cloud telephony providers) that lets configuration information be read. It covers scope and fixes from a defender's point of view and leaves out how to attack.
- CVE
- CVE-2026-20320 (Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt)
- Severity
- CVSS v3.1 7.5 (High; vector AV:N/AC:L/PR:N/UI:N, confidentiality only; assigned by Cisco)
- Type
- Improper restriction of XML external entity reference (CWE-611). Configuration information can be read without authentication
- Affected
- BroadWorks Application Delivery Platform / Application Server / Profile Server / Xtended Services Platform, earlier than RI.2026.07
- Fix
- RI.2026.07. No workaround
- Published
- Cisco advisory: 19 August 2026 (first version only)
- Exploitation
- Added to CISA KEV on 10 November 2026 (due 24 November). The Cisco advisory says it was not aware of malicious use
What kind of vulnerability this is
The Cisco advisory says the OCI XML parser allows external entity resolution by default, so an unauthenticated remote attacker who sends crafted XML to the OCI-P service can read sensitive files on the filesystem with the privileges of the BroadWorks user. In the CVSS vector only confidentiality is high; integrity and availability are unaffected. The data format is not described in the advisory, and this site does not describe it either.
Scope
| Product | Affected versions | Fix |
|---|---|---|
| BroadWorks Application Delivery Platform | Earlier than RI.2026.07 (Open Client Server [OCS] and OCIOverSoap components) | RI.2026.07 |
| BroadWorks Application Server | Earlier than RI.2026.07 | RI.2026.07 |
| BroadWorks Profile Server | Earlier than RI.2026.07 | RI.2026.07 |
| BroadWorks Xtended Services Platform | Earlier than RI.2026.07 | RI.2026.07 |
- All four are affected regardless of device configuration. Products not listed are not confirmed affected.
- There is no workaround. Cisco advises upgrading to fully remediate.
- If you use BroadWorks through a reseller or a managed service, decide by the same versions and check your provider's guidance.
What to do today (for operators)
Inventory BroadWorks components and versions
Count Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform for each production, test and disaster-recovery environment, and check whether each is earlier than RI.2026.07 (asset inventory checklist).
Update to RI.2026.07
Follow Cisco's procedure. The KEV due date is 24 November. For environments that cannot be taken down, plan a rolling update, one side of each redundant pair at a time, working back from the due date.
Limit who can reach OCI-P until you update
Cisco gives no workaround. As this site's own addition, restrict the sources that can reach the OCI-P service to the operations systems and networks needed for provisioning. Confirm it is not open to the internet or to untrusted partner networks. This is an interim measure to reduce exposure, not a substitute for the update.
Review credentials in configuration files
What can be read is whatever the BroadWorks user can read. If configuration holds database, integration or administrative credentials, assume they may have been read and consider rotating them. Also check logs for unexpected access to OCI-P (vulnerability response playbook).
Exploitation status
- CISA added it to KEV on 10 November 2026 with a due date of 24 November (KEV version 2026.11.10). This site takes the KEV listing as the evidence of exploitation.
- The Cisco advisory is still its 19 August first version (no revisions) and says Cisco was not aware of public announcements or malicious use. The sources differ on exploitation.
- In KEV, ransomware use is Unknown and forensic triage is No. This listing does not require a compromise check.
- The CVE record carries CISA's assessment (active exploitation, automatable, partial technical impact).
- NVD status is Analyzed.
- The CVE record and third-party analysis referenced by NVD exist, but this site has not corroborated their content and does not describe the details.
This site's view: a moderate score changes priority once a due date is attached
At CVSS 7.5, with only configuration information exposed, it is tempting to treat this as non-urgent. But a KEV listing means exploitation is real, and it should outweigh the CVSS number. For a fix that has been public for three months, work back from the due date (24 November) and make the update plan this week (prioritising with CVSS, EPSS and KEV).
Sources
- Cisco — Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (published 19 August 2026, first version only; affected products, fix, no workaround, CVSS 7.5)
- CVE.org — CVE-2026-20320 (includes CISA's additions)
- NVD — CVE-2026-20320 (Analyzed; CWE-611)
- CISA KEV — Known Exploited Vulnerabilities Catalog (added 10 November, due 24 November)
Last verified: 11 November 2026.
Read next
- Practice: Vulnerability response playbook / Asset inventory checklist
- Decision: Prioritising with CVSS, EPSS and KEV
- Glossary: What is CVSS