# Cisco BroadWorks: exploited flaw can expose configuration files Canonical: https://www.oktsec.com/radar/cisco-broadworks-cve-2026-20320 Publisher: Oktsec Language: en Published: 2026-11-11T19:05:04Z Updated: 2026-11-11T19:05:04Z Record reviewed: 2026-11-11T19:05:04Z Latest evidence check: 2026-11-11T19:05:04Z Disclosed: 2026-08-19 CISA added CVE-2026-20320 to KEV on November 10. An unauthenticated attacker able to reach the BroadWorks OCI-P service can read sensitive files with the BroadWorks user’s privileges. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA confirms exploitation of this exact CVE. A remote attacker needs access to OCI-P but no credentials; Cisco provides corrected releases and no workaround. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: No login required - Vendor: Cisco - Products: BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, BroadWorks Xtended Services Platform - CVEs: CVE-2026-20320 - Vendor severity: CVSS 3.1 7.5 ## Technical overview Cisco disclosed this XML parser flaw on August 19. External entity resolution allows a crafted OCI-P message to read sensitive files with the privileges of the BroadWorks user. Cisco lists four affected components regardless of their device configuration; the relevant service still has to be reachable. The August advisory says Cisco was not aware of malicious use at publication. CISA’s November 10 KEV entry supplies newer evidence of exploitation of CVE-2026-20320. That entry does not identify every affected deployment or establish that all exposed systems were compromised. Cisco identifies RI.2026.07 as the first fixed release for the listed products. Oktsec recommends combining the upgrade with restricted provisioning access and a review of earlier activity. The documented impact is disclosure of files, not demonstrated remote code execution. ## Recommended response Upgrade affected BroadWorks components to RI.2026.07 or a later corrected release. Restrict OCI-P reachability and review earlier requests for signs of configuration disclosure. Relevant to: Telecom operators and teams maintaining the affected Cisco BroadWorks provisioning components. ## CVE attribution - CVE-2026-20320: Cisco — BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, BroadWorks Xtended Services Platform. [Source](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt) ## Affected systems and fixes ### BroadWorks Application Delivery Platform Affected: Earlier than RI.2026.07; OCS and OCIOverSoap Fixed release / action: RI.2026.07 ### BroadWorks Application Server Affected: Earlier than RI.2026.07 Fixed release / action: RI.2026.07 ### BroadWorks Profile Server Affected: Earlier than RI.2026.07 Fixed release / action: RI.2026.07 ### BroadWorks Xtended Services Platform Affected: Earlier than RI.2026.07 Fixed release / action: RI.2026.07 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-11T19:05:18.382Z ### [CVE-2026-20320](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20320) - Added: 2026-11-10 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-24 - Federal forensic triage: No Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-11T19:05:18.382Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-20320](https://api.first.org/data/v1/epss?cve=CVE-2026-20320): 0.39% probability of observed exploitation in the next 30 days; percentile 32.92%; score date 2026-11-10. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-11T19:05:18.382Z. ### Official regional advisories - [CSIRT Panamá Aviso 2026-nov-11: Vulnerabilidad Crítica en Cisco BroadWorks que permite leer archivos sensibles sin autenticarse — CVE-2026-20320](https://cert.pa/?p=6275) — CSIRT Panamá, Panama; publication 2026-11-11; observed 2026-11-11T19:05:18.382Z; matched by exact CVE identifier. - [Vulnerabilidad en productos Cisco](https://www.cert.gov.py/vulnerabilidad-en-productos-cisco-12/) — CERT-PY, Paraguay; publication 2026-11-11T11:07:15.000Z; observed 2026-11-11T19:05:18.382Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Identify BroadWorks components and OCI-P access** — Check Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform releases. For Application Delivery Platform, Cisco lists OCS and OCIOverSoap. Determine which clients can reach OCI-P. 2. **Install the corrected software** — Upgrade to RI.2026.07 or a later release containing the correction for each listed component. Cisco states that no workaround addresses the vulnerability. 3. **Review possible earlier disclosure** — Oktsec recommends restricting provisioning access to required clients and reviewing logs for unusual XML requests or file access. If evidence indicates exposed secrets, rotate those secrets and examine related activity; an upgrade does not revoke them. ## Relevance to AI environments If automation stores credentials in BroadWorks configuration, assess their exposure after unauthorized file access; this is not an AI specific flaw. ## Sources - [BroadWorks XML parser advisory and fixed software](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt) — Cisco; Vendor notice; checked 2026-11-11T19:05:04Z - [CISA KEV: exact CVE record](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-11T19:05:04Z ## Editorial record - 2026-11-11T19:05:04Z: Added the August advisory with exact product corrections and the November 10 CISA exploitation confirmation. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/cisco-broadworks-cve-2026-20320) · [Build a response plan](https://www.oktsec.com/radar/cisco-broadworks-cve-2026-20320#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-broadworks-cve-2026-20320&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-broadworks-cve-2026-20320&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.