Cisco

Cisco BroadWorks OCI XXE flaw CVE-2026-20320 added to KEV, lets unauthenticated attackers read sensitive server files

Cisco disclosed on August 19, 2026 that the Open Client Interface (OCI) XML parser in BroadWorks resolves external entities by default, letting an unauthenticated remote attacker send crafted XML to the OCI-P service and read sensitive files with the privileges of the BroadWorks user .