The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity vulnerability in Cisco BroadWorks in their attacks.
Cisco BroadWorks is a cloud Unified Communications (UC) software platform and the underlying engine that enables telecommunications carriers and managed service providers (MSPs) to deliver branded cloud PBX, voice, and collaboration services to business customers.
Tracked as CVE-2026-20320The security flaw stems from an improper restriction of the XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML parser which may allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending malicious XML messages.
“This vulnerability exists because XML entries are incorrectly parsed due to the external entity resolution allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service,” Cisco explained when it fixed the bug in August.
LPCC reported CVE-2026-20320 as actively exploited and added it to its Catalog of Known Exploited Vulnerabilities (KEV) Tuesday, directing Federal Civilian Executive Branch (FCEB) agencies to secure their systems within two weeks, by November 24, as required by Binding Operational Directive (BOD) 26-04.
Although BOD 26-04 only targets federal agencies, CISA urged all security teams, including those in the private sector, to prioritize fixes for this vulnerability to defend their networks against ongoing attacks.
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and present significant risks to the federal enterprise,” he warns. “Although BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV catalog vulnerabilities. »
Targeted in autonomous AI attack
Although CISA has not shared more details about attackers exploiting CVE-2026-20320 in the wild, threat intelligence firm Malbear Labs said this weekend that a Chinese-speaking threat actor exploited the flaw using a jailbroken DeepSeek Flash artificial intelligence model in attacks targeting a European telecommunications provider and thirteen organizations that used its data centers and cloud infrastructure.
The attack focused on the telecommunications provider’s BroadWorks XSP (eXtended Services Platform), and Malbear Labs discovered that the BroadWorks Provisioning Server (which stores subscriber configuration for all users) was also exposed via an unauthenticated directory listing.
“The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser. A crafted OCI request on port 2208 causes the XML parser to read arbitrary files from the server’s file system and no prior authentication is required,” Malbear Labs said.
“From the XSP host, the agent retrieved the system identity private key, three sets of SSL credentials, and three additional private keys with confirmed certificate matches. The system identity key is used by the BroadWorks platform to authenticate between its own components; its possession allows impersonation of the XSP in inter-component communication.
Since November 2021, CISA has added 103 Cisco vulnerabilities to its list of actively exploited vulnerabilities, seven of which have also been exploited by ransomware gangs.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
