Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws in Cisco BroadWorks and Openwave Messaging to its Known Exploited Vulnerabilities catalog on Tuesday, citing evidence of active exploitation.
The agency's move follows a trend of actively exploited flaws in enterprise networking and communications equipment. The vulnerabilities are CVE-2026-20320 and CVE-2026-111793.
CVE-2026-20320 is a high-severity (CVSS 7.5) improper restriction of XML external entity reference vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. It could allow an unauthenticated, remote attacker to read sensitive configuration information with the privileges of a Cisco BroadWorks user. The flaw was fixed in August 2026.
CVE-2026-111793 is a medium-severity (CVSS 4.3) incorrect resource transfer vulnerability in the Openwave Messaging Webtop Media Transcoder. It could allow an authenticated user to process and convert unintended document types if they bypass the Webmail experience. This flaw was fixed in October 2026.
There are currently no details on how the vulnerabilities are being exploited in real-world attacks, nor have they been attributed to a specific named threat actor or group. Cisco's advisory also makes no mention of the flaw being maliciously used.
In light of the active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 24, 2026, to secure their networks.
Related
