CISA added Cisco BroadWorks flaw CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on November 10, two days after researchers reported that a Chinese-speaking threat actor used it against a European telecom provider and more than a dozen other organizations.
The catalog entry carries a federal remediation deadline of November 24.
CVE-2026-20320: Blind XXE Through the OCI-P Service
CVE-2026-20320 is a blind XML external entity (XXE) flaw in the OCI-P service of Cisco BroadWorks. An unauthenticated remote attacker can use it to read sensitive configuration data. The flaw affects the BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform.
Cisco fixed the vulnerability in release RI.2026.07 and disclosed it on August 19. The attacks therefore targeted a flaw for which a patch had been available for months, which indicates that unpatched BroadWorks deployments remained exposed through the autumn.
What the Malbear Labs Report Describes
Malbear Labs reported on November 8 that a Chinese-speaking actor was exploiting the flaw against a European telecom provider and at least 13 other organizations. The actor’s activity included asset enumeration, credential theft, and the harvesting of billing and device records.
The report does not name the telecom provider. The data types it describes, billing records and device records, are the kind that carriers hold in bulk and that have value for intelligence collection or follow-on attacks.
CISA Deadline and the Openwave Webtop Addition
CISA’s catalog entry for CVE-2026-20320 sets a November 24 deadline for federal civilian agencies. CISA also added a flaw in Openwave Webtop, CVE-2026-111793, to the catalog the same day. This article centers on the BroadWorks vulnerability, because the Openwave flaw was covered separately earlier in the week.
Why the KEV Listing Follows the Research by Two Days
The sequence, a researcher report on November 8 and a catalog addition on November 10, shows the typical path from public exploitation reporting to an official federal directive. A KEV listing gives agencies a deadline and signals to private-sector defenders that exploitation is confirmed.
Telecom Infrastructure as a Target for Billing and Credential Data
Carrier platforms like BroadWorks run voice and unified-communications services for service providers and enterprises. Their configuration data and subscriber records can expose both network structure and customer information. An unauthenticated read capability against that data is a useful starting point for an attacker mapping a carrier’s environment.
The actor’s use of the flaw for credential theft is notable because stolen credentials can outlast the vulnerability that yielded them. A provider that applies the RI.2026.07 fix after an intrusion has closed the entry point, but credentials already taken could still provide access unless they are rotated.
Organizations running BroadWorks should confirm that they have installed RI.2026.07 or later and should review for signs of earlier access, since the vulnerability has been public since August and exploitation has now been confirmed. The reporting names a European telecom and at least 13 other organizations as victims, which suggests that exposure is not limited to a single carrier. The listing’s November 24 deadline gives federal agencies two weeks, but providers outside the federal sphere face no such date and rely on their own risk assessments.
What Telecom Customers and Providers Should Check
Providers and enterprises that run BroadWorks components, including the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform, can verify their release against RI.2026.07. Because the flaw allows unauthenticated reads of sensitive configuration data, any exposed OCI-P service was in scope before patching.
The activity Malbear Labs describes, asset enumeration followed by credential theft and billing and device record harvesting, outlines the sequence defenders should look for in logs. Reviewing for unexplained access to configuration data and for credential use from unfamiliar locations would show whether an intrusion preceded the fix.
