CISA Confirms Exploitation of Cisco BroadWorks XML File Disclosure
Tech GuruQuick Answer
Update affected BroadWorks components to RI.2026.07 or later. Review OCI-P exposure and unexpected configuration access, preserve logs and validate provisioning and communications services.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product and component versions, exposure, administrative controls, service owners and maintenance dependencies. Match the four listed BroadWorks component families and exact releases. CISA now confirms exploitation even though Cisco’s older bulletin still says it was not aware of malicious use. Apply Cisco’s fixed release through the supported upgrade path. Cisco lists no workaround. Verify each component version, test provisioning and calling workflows, and retain service and access-log evidence.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform |
|---|---|
| Advisory | cisco-sa-bworks-xxe-uwUd7CEt / CISA-KEV-CVE-2026-20320 |
| CVE | CVE-2026-20320 |
| CISA KEV addition and catalog release | November 10, 2026 (KEV addition); catalog released at 2026-11-10T19:03:29.837500Z. |
| Authority revision date | Underlying vendor advisory released 2026-08-19T16:00:00Z. The new event is CISA KEV inclusion. |
| Affected versions | The listed BroadWorks products before RI.2026.07, regardless of device configuration. Application Delivery Platform scope includes Open Client Server and OCIOverSoap. |
| Fixed version | BroadWorks RI.2026.07 or later for each listed product |
| CVSS base score | 7.5 (Cisco CVSS v3.1 base score) |
| CVSS severity | High |
| Exploitation status | CISA confirms exploitation through its November 10, 2026 KEV addition. Ransomware campaign use is Unknown.; no exploitation claim is inferred. |
What Changed
CISA added the OCI XML parser vulnerability to KEV. The underlying Cisco advisory describes unauthenticated reads of sensitive files through the OCI-P service.
What To Validate Now
- Inventory. Record product and component versions, exposure, administrative controls, service owners and maintenance dependencies.
- Establish applicability. Match the four listed BroadWorks component families and exact releases. CISA now confirms exploitation even though Cisco’s older bulletin still says it was not aware of malicious use.
- Remediate. Apply Cisco’s fixed release through the supported upgrade path. Cisco lists no workaround.
- Validate. Verify each component version, test provisioning and calling workflows, and retain service and access-log evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CISA lists November 24, 2026 as the due date and forensic triage No. Apply applicable federal directive obligations or the organization’s governing process. Coordinate service availability.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
