Search advisories

Cisco disclosed on August 19, 2026 that the Open Client Interface (OCI) XML parser in BroadWorks resolves external entities by default, letting an unauthenticated remote attacker send crafted XML to the OCI-P service and read sensitive files with the privileges of the BroadWorks user .