CISA sets two-week deadline for exploited Cisco BroadWorks flaw

By Olivia Hart

CISA on Tuesday gave federal civilian agencies two weeks—by November 24—to patch CVE-2026-20320 after adding the actively exploited Cisco BroadWorks flaw to its Known Exploited Vulnerabilities, or KEV, catalog.

At a European telecommunications provider, an autonomous AI agent sent a crafted request to port 2208 on a BroadWorks XSP server. The request forced an XML parser to read files without authentication, and the operation also targeted 13 organizations using the provider’s data centers and cloud infrastructure.

Malbear Labs said: “The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser. A crafted OCI request to port 2208 causes the XML parser to read arbitrary files from the server filesystem and no prior authentication required.”

Malbear Labs reported over the weekend that a Chinese-speaking threat actor combined the exploit with a jailbroken DeepSeek Flash artificial intelligence model. The activity focused on the provider’s BroadWorks XSP, or eXtended Services Platform, deployment and the 13 organizations.

BroadWorks sits within enterprise communications infrastructure. Cisco’s cloud unified communications platform serves as the underlying engine for telecom carriers and managed service providers, or MSPs, that offer branded cloud PBX, voice and collaboration services to business customers.

CISA disclosed no further details about the attackers or campaign.

The vulnerable service

Tracked as CVE-2026-20320, the high-severity flaw is an improper restriction of XML External Entity references, an XXE weakness, in the Open Client Interface, or OCI, XML Parser. Cisco patched it in August. It lets unauthenticated remote attackers read sensitive configuration information by sending maliciously crafted XML to the Open Client Interface–Provisioning, or OCI-P, service.

Cisco attributed the weakness to XML entries being improperly parsed because external entity resolution remained enabled by default. A crafted XML message sent to OCI-P can therefore make the parser retrieve sensitive data from a vulnerable system.

The observed intrusion

Malbear Labs also found the BroadWorks Provisioning Server exposed through an unauthenticated directory listing. The server stores subscriber configuration for all users. The agent recovered:

• The system identity private key.
• Three SSL credential sets.
• Three additional private keys; Malbear Labs confirmed matching certificates.

BroadWorks uses the system identity key to authenticate its own components. Malbear Labs said possession of that key allows an attacker to impersonate XSP in inter-component communication.

What changes for BroadWorks operators?

The practical change is remediation priority. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch, or FCEB, agencies must secure their systems by November 24. The directive applies only to FCEB agencies, but CISA urged every security team, including private-sector teams, to adopt risk-based vulnerability management and prioritize KEV patches.

CISA warned: “These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.”

For carriers and MSPs, patching closes the reported unauthenticated entry path, but the recovered identity material creates a separate component-impersonation risk. The breach involved three SSL credential sets and three additional private keys, plus the system identity key.

Since November 2021, CISA has added 103 Cisco vulnerabilities to its actively exploited list. Ransomware gangs abused seven of them.

The federal deadline is mandatory; for private operators, CISA’s KEV designation makes the same BroadWorks patch the priority.