Cisco BroadWorks: XXE flaw (CVE-2026-20320) exploited in the wild, fixed in RI.2026.07
Published 10/11/2026 23:01 · Updated 11/11/2026 19:13 (revision 2)
Timeline
5 events over 3 d 18 h
- 08/11/2026ConfirmedVulnCheck KEV+2 d
- 10/11/2026CorroboratedCISA Known Exploited Vulnerabilities+0 min
- 10/11/2026ExploitedCISA Known Exploited Vulnerabilities+22 h
- 10/11/2026 23:01Published on WatchtowerPro CISO+20 h
- 11/11/2026 19:13UpdatedCISA added the Cisco BroadWorks XXE flaw (CVE-2026-20320) to its known-exploited list on…
In short
Cisco BroadWorks has an XML external entity (XXE) flaw that lets an unauthenticated attacker read sensitive configuration files over the network. CISA lists it as exploited in attacks, and VulnCheck cited a Malbear Labs write-up. Cisco has released fixed software (RI.2026.07) and offers no workaround. GreyNoise reports a public exploit for CVE-2026-20320; listed by CISA as known exploited (11/11/2026).
How bad is it
High. An attacker who can reach a vulnerable BroadWorks server over the network can read sensitive configuration files on it, without logging in.
Being exploited - on CISA's known-exploited list since 10/11/2026.
Severity score
CVSS 3.1 from NVD, from cisco.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
Type: information disclosure.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Cisco BroadWorks Application Delivery Platform, running a release earlier than RI.2026.07
- Cisco BroadWorks Application Server, running a release earlier than RI.2026.07
- Cisco BroadWorks Profile Server, running a release earlier than RI.2026.07
- Cisco BroadWorks Xtended Services Platform, running a release earlier than RI.2026.07
- Cisco says the flaw applies regardless of device configuration
What to do now
- Upgrade all affected Cisco BroadWorks products (Application Delivery Platform, Application Server, Profile Server, Xtended Services Platform) to release RI.2026.07 or later. Cisco states that upgrading is the full fix.
- Cisco offers no workaround and no interim setting for this flaw. Any restriction you add yourself, such as limiting network access to the OCI-P service, only reduces exposure and does not make a server safe.
- Check with your hosting provider or telecom operator whether your BroadWorks servers have been upgraded.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 2 open questions, followed up as sources answer, all 5 sources with their dates and every revision. And technology matching: which of your systems run Cisco BroadWorks, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Cisco BroadWorks - Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability Vendor · Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability Vendor · Known exploited (VulnCheck KEV): Cisco BroadWorks - Cisco broadworks_application_delivery_platform Improper Restriction of XML External Entity Reference Research