Cisco BroadWorks unauthenticated XXE exploited to read files, now in CISA KEV

CVE-2026-20320 is an out-of-band blind XML External Entity (XXE) injection in the Open Client Interface (OCI) XML parser of Cisco BroadWorks ¹. A remote attacker with no credentials can send a crafted XML message to the OCI-Provisioning (OCI-P) service and read sensitive configuration and filesystem contents as the BroadWorks user ¹. Cisco published the advisory and the fixed release RI.2026.07 on 2026-08-19 and rated the flaw CVSS 7.5 ¹.

The Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform are all affected before RI.2026.07, whatever their configuration ¹. Practical exposure depends on whether an attacker can reach OCI-P. Cisco lists no workarounds ¹.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-11-10, with a federal remediation date of 2026-11-24 ^2,3,6. The public account of exploitation comes from Malbear Labs, which reported on 2026-11-08 that an autonomous AI intrusion harness used the flaw to enter a European telecom provider through its BroadWorks XSP ^4,5. Thirteen organizations hosted on that provider's infrastructure were in scope ⁴. Malbear describes the operator only as Chinese-speaking, and no vendor or government has named an actor ⁴. Coverage by The Hacker News and SecurityWeek draws on Malbear and CISA rather than independent telemetry ^5,6.

The bug is CWE-611, improper restriction of XML external entity references ¹. Cisco attributes it to the OCI XML parser resolving external entities by default, so attacker-supplied entity declarations in an OCI-P message get processed ¹. Because the flaw is blind and out-of-band, file contents do not come back in the protocol response. Data instead leaves through a connection the parser makes to infrastructure the attacker controls, which is why egress monitoring matters.

Exploitation needs network access to OCI-P and no authentication or user interaction ¹. Impact is limited to confidentiality: integrity and availability are not affected in the CVSS scoring ¹. Even so, readable files on a BroadWorks host can include key material. In the documented intrusion, the agent recovered the XSP's system identity private key, three SSL credential sets and three more private keys ^4,5. Malbear notes the identity key lets an attacker impersonate the XSP in communication between BroadWorks components ^4,5.

The victim XSP ran release 23.0.1.1075 with the OCI service reachable on TCP 2208 ⁵. That is one deployment, and the sources do not map it to the RI release scheme. The wider campaign took subscriber billing and device records over about two weeks. It also used Sliver, Chisel, the Behinder web shell and exploits for many other products, so not all of that activity traces back to this flaw ⁵.

1. 1

   Upgrade every BroadWorks ADP, Application Server, Profile Server and Xtended Services Platform to RI.2026.07 or later. Cisco states no workaround addresses the flaw ¹.

2. 2

   Under CISA's KEV listing, US federal agencies must apply vendor mitigations by 2026-11-24, or stop using the product if mitigations are unavailable ^2,6.

3. 3

   Until patched, limit OCI-P access to known provisioning clients on trusted networks, and block internet access to the service. This is exposure reduction, not a vendor-endorsed fix.

4. 4

   If OCI-P was reachable by untrusted parties before patching, assume the host's files were read. Rotate the system identity private key, SSL certificates and other private keys stored on BroadWorks hosts, since these were stolen in the observed intrusion ^4,5.

5. 5

   On previously exposed systems, run a forensic review for Sliver, Chisel and Behinder artifacts and for lateral movement from BroadWorks hosts ⁵. Check egress logs for the published campaign infrastructure ⁴.

• Cisco publishes no detection guidance, signatures or IOCs for this CVE ¹. The hunts below are defender guidance built from the campaign reporting.
• Inventory every BroadWorks ADP, Application Server, Profile Server and XSP node and confirm it runs RI.2026.07 or later ¹. Treat anything older as exposed.
• Map where OCI-P can be reached from. The observed victim exposed the OCI service on TCP 2208 ⁵. Flag any listener reachable from the internet or untrusted segments.
• Review OCI-P request logs for unauthenticated messages containing DOCTYPE or ENTITY declarations, especially from sources other than known provisioning clients.
• Alert on outbound HTTP, FTP or DNS from BroadWorks servers to unfamiliar hosts. Blind out-of-band XXE exfiltrates data through such callbacks.
• Search egress, proxy and DNS logs for the Operation Snowball infrastructure listed under IOCs ⁴. The published list may be incomplete.
• On BroadWorks hosts and adjacent systems, look for Sliver implants, Chisel tunnels and the Behinder web shell, which this campaign used ⁵.

1. Aug 19, 2026

   Cisco publishes advisory cisco-sa-bworks-xxe-uwUd7CEt with fixed release RI.2026.07 and reports no known malicious use. ¹

2. Nov 8, 2026

   Malbear Labs publishes 'Operation Snowball', documenting exploitation of the flaw against a European telecom provider's BroadWorks XSP. ⁴

3. Nov 10, 2026

   CISA adds CVE-2026-20320 to the Known Exploited Vulnerabilities catalog. ²

4. Nov 24, 2026

   KEV remediation due date for US federal agencies. ²

1. 1
   Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

   Cisco · Vendor · Aug 19, 2026
2. 2
   CISA KEV entry for CVE-2026-20320

   CISA · Government · Nov 10, 2026
3. 3
   CISA Adds Six Known Exploited Vulnerabilities to Catalog

   CISA · Government · Nov 10, 2026
4. 4
   Operation Snowball: Inside an Autonomous AI Intrusion Campaign

   Malbear Labs · Research · Nov 8, 2026
5. 5
   Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

   The Hacker News · News
6. 6
   Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities

   SecurityWeek · News · Nov 11, 2026