HighCVSS7.52026-11-11
CVE-2026-20320 — Cisco BroadWorks XXE lets an unauthenticated attacker read configuration information: explainer and fix (fixed in RI.2026.07, listed in KEV)
In the Open Client Interface (OCI) XML parser of Cisco BroadWorks, external entity resolution is allowed by default, so an unauthenticated attacker can read configuration information through the OCI-P service (CWE-611, CVSS 7.5). Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform earlier than RI.2026.07 are affected, with no workaround. The Cisco advisory is still its 19 August first version and says Cisco was not aware of malicious use. CISA added it to KEV on 10 November (due 24 November). This site's view: update to RI.2026.07, limit who can reach OCI-P until then, and consider rotating credentials found in configuration files.