Cisco BroadWorks flaw exposes sensitive files; exploited in the wild

What happened

Cisco has disclosed a vulnerability, tracked as CVE-2026-20320, in the XML parser behind the Open Client Interface (OCI) of Cisco BroadWorks. The parser resolves external entities by default, a weakness classed as an XML external entity (XXE) issue.

By sending a specially constructed XML message to the OCI Provisioning (OCI-P) service, an attacker who needs no credentials could get the system to disclose files from its filesystem. That includes sensitive configuration information. Exposure is limited to files that the account running Cisco BroadWorks can read.

The flaw was published on 2026-08-19. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-11-10, which means it is being exploited in the wild.

Who is affected

The issue affects several Cisco BroadWorks components:

BroadWorks Application Delivery Platform versions earlier than ri.2026.07.

BroadWorks Application Server (release independent) versions earlier than 2026.0.

BroadWorks Profile Server (release independent) versions earlier than 2026.07.

BroadWorks Xtended Services Platform (release independent) versions earlier than 2026.07.

Organizations that run any of these components with the OCI-P service reachable over the network should treat the issue as urgent.

How serious is it

Cisco gives the flaw a CVSS 3.1 base score of 7.5, which places it in the high range. The score reflects that an attacker can reach the service over the network without credentials or user interaction, and that the impact is on confidentiality rather than integrity or availability.

Active exploitation raises the urgency. CISA lists the flaw in its Known Exploited Vulnerabilities catalog and has set a remediation due date of 2026-11-24 for US federal agencies. The EPSS score, an estimate of the likelihood of exploitation, is 0.00385. The confirmed exploitation in the wild matters more for prioritization than that estimate. Configuration data read through this flaw could help attackers prepare further attacks.

What you should do

1. 1Identify all Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform systems in your environment.
2. 2Apply the fixed releases and mitigations described in Cisco's security advisory for this flaw.
3. 3Restrict network access to the OCI-P service to trusted systems only.
4. 4Review affected systems for signs of compromise, as the flaw is being actively exploited.
5. 5Federal agencies should complete remediation by the CISA due date of 2026-11-24 or stop using the product if mitigations are unavailable.

Quick facts