Cisco BroadWorks OCI XXE flaw CVE-2026-20320 added to KEV, lets unauthenticated attackers read sensitive server files

Cisco disclosed on August 19, 2026 that the Open Client Interface (OCI) XML parser in BroadWorks resolves external entities by default, letting an unauthenticated remote attacker send crafted XML to the OCI-P service and read sensitive files with the privileges of the BroadWorks user ^[1]. CISA added CVE-2026-20320 to the Known Exploited Vulnerabilities catalog on November 10, although Cisco’s advisory said at the time it was not aware of malicious use, and no attack details have been published ^[1][2]. Operators of BroadWorks Application Delivery Platform, Application Server or Xtended Services Platform should upgrade to the fixed release in Cisco’s advisory, since there are no workarounds ^[1].

Organisations running: Cisco BroadWorks（Application Delivery Platform、Application Server、Xtended Services Platform）

Operators of BroadWorks Application Delivery Platform, Application Server or Xtended Services Platform should upgrade to the fixed release in Cisco’s advisory, since there are no workarounds ^[1]