Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
TL;DR 📌
- Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
- Highest CVSS: 7.5 (High).
- Listed in CISA KEV (2026-11-10) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-20320.
What it is
CVE-2026-20320 is an XML External Entity (XXE) injection vulnerability in the Open Client Interface (OCI) XML parser used by Cisco BroadWorks. The parser resolves external entities by default when handling incoming XML, rather than rejecting them.
The affected entry point is the OCI-P (Open Client Interface – Provisioning) service. An unauthenticated, remote attacker can send a crafted XML message to this service over the network, with no credentials and no user interaction required.
A successful exploit lets the attacker read arbitrary files from the underlying filesystem, with the privileges of the Cisco BroadWorks user account. The impact is confined to disclosure of sensitive configuration data and files; the CVSS vector confirms no integrity or availability impact, only confidentiality (C:H/I:N/A:N). This is a data exposure issue on the provisioning management interface, not a path to code execution or service disruption as described.
CVE-2026-20320 is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-11-10.
What to do
- Check the Cisco advisory at the NVD link for fixed software releases — none were available at the time of writing, so confirm current patch status directly with Cisco before assuming you’re covered.
- Restrict network access to the OCI-P interface to trusted management networks only; this service should never be exposed to untrusted or public networks given it requires no authentication.
- Given the KEV listing, treat this as a priority patching action once a fix is published, rather than something to queue behind lower-severity work.
- Review BroadWorks provisioning logs for unusual or malformed XML payloads sent to OCI-P as a interim detection measure while awaiting a fix.
- If your deployment allows it, check whether external entity resolution can be disabled or restricted in the XML parser configuration independent of a vendor patch, and apply that as a stopgap.
For leadership 🧭
Executive summary. A remotely exploitable flaw in Cisco BroadWorks’ provisioning interface lets anyone on the network pull sensitive configuration files and other data off the server without credentials, and CISA has confirmed it is already being exploited. Because no fix is yet listed, exposure should be cut off at the network level immediately rather than waiting for a patch.
Why it matters:
- The OCI-P provisioning service accepts XML from unauthenticated remote callers, so any network path to that interface is an exploitable path to the filesystem.
- Attackers can read arbitrary files with the privileges of the BroadWorks user account, including configuration data that typically holds credentials, routing and tenant information for a carrier-grade telephony platform.
- CISA added this to its Known Exploited Vulnerabilities catalogue on 2026-11-10, meaning it is actively being used rather than theoretical.
- No fixed release is listed yet, so the only current controls are network restriction and parser configuration changes, not a vendor patch.
Now / Next / Later:
- Now: Identify every instance where the OCI-P interface is reachable from outside a trusted management network and firewall it off immediately.
- Next: Check the parser configuration for an option to disable external entity resolution independently of a vendor patch, and apply it as a stopgap during the next change window.
- Later: Track Cisco’s advisory for a fixed BroadWorks release and schedule it as priority patching the moment one is published, given the confirmed KEV status.