CISA Adds Cisco BroadWorks Vulnerability to KEV Catalog
CISA has added CVE-2026-20320 in Cisco BroadWorks to the Known Exploited Vulnerabilities catalog. Cisco recommends updating to RI.2026.07 because no workaround exists.
The Cisco BroadWorks vulnerability CVE-2026-20320 was added to the U.S. agency CISA’s Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026. The listing means the flaw’s exploitation has been confirmed. Cisco does not provide an alternative mitigation for the issue, and the recommended solution is to update to the fixed RI.2026.07 release or later.
The Cisco BroadWorks vulnerability is an XXE flaw
CVE-2026-20320 affects the XML parser of the Open Client Interface in Cisco BroadWorks. It is an XML External Entity vulnerability, abbreviated as XXE. According to Cisco’s security advisory, an unauthenticated remote attacker could exploit it to read sensitive configuration data.
The impact is tied to the privileges of a BroadWorks user. An attacker could therefore read sensitive files and configuration to which that user has access. Cisco rates the flaw High and lists a CVSS score of 7.5.
Releases before RI.2026.07 are affected
According to Cisco, BroadWorks releases before RI.2026.07 are affected. A fix is available in release RI.2026.07. The vendor also states that no workaround exists for this flaw—an alternative measure that would replace the update.
Operators should therefore identify Cisco BroadWorks installations running an older release and plan a transition to the fixed version according to the vendor’s instructions. For the KEV catalog entry, CISA likewise recommends following the vendor’s instructions.
KEV increases remediation priority
The KEV catalog collects vulnerabilities for which CISA has recorded exploitation. In the case of CVE-2026-20320, this is therefore not merely a publicly known flaw with a potentially theoretical impact, but an issue with confirmed exploitation.
CISA and Cisco did not disclose the scope of exploitation, affected organizations, the attacker’s identity, or technical indicators of compromise in the materials used. A connection between the flaw and ransomware campaigns has also not been confirmed.
Further information may come from possible updates by Cisco or CISA, particularly details about the exploitation method, indicators of compromise, or forensic recommendations. For now, the specific step for administrators is to update releases before RI.2026.07 to the fixed version.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms that CVE-2026-20320 was added to the KEV catalog on November 10, 2026, and recommends following the vendor’s instructions.
- Cisco Security Advisory: Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability – Confirms the technical nature of the flaw, unauthenticated remote exploitation, the CVSS rating of 7.5, the absence of a workaround, and the fix in RI.2026.07.
Verified and updated: 11/11/2026 06:28
