Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

Cisco has confirmed that a critical vulnerability in its BroadWorks platform is being actively exploited in the wild. The issue, identified as CVE-2026-20320, affects multiple products including BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. The vulnerability has a CVSS score of 7.5 and allows unauthenticated, remote attackers to read sensitive configuration information on affected systems.

The vulnerability exists in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks, where XML entries are improperly parsed due to external entity resolution being allowed by default. Attackers can exploit this by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service, potentially viewing sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Active Exploitation Confirmed

In November 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability, prompting the company to update its security advisory. The vulnerability was first published on August 19, 2026, and was last updated on November 12, 2026, to reflect the ongoing exploitation. Cisco considers any workarounds to be temporary solutions and strongly recommends customers upgrade to fixed software releases.

Affected Products and Fixes

The vulnerability affects multiple Cisco products if they are running a vulnerable release of Cisco BroadWorks, regardless of device configuration. These include BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. Cisco has released software updates that address the vulnerability, with the first fixed release being RI.2026.07 for all affected products.

For customers who cannot obtain fixed software through their point of sale, Cisco advises contacting the Cisco Technical Assistance Center (TAC) with their product serial number and the URL of the advisory as evidence of entitlement to a free upgrade. The company emphasizes that devices to be upgraded should contain sufficient memory and that current hardware and software configurations will continue to be properly supported by the new release.

Discovery and Acknowledgment

The vulnerability was discovered by researcher Sandesh M Gawai, whom Cisco thanked for reporting the issue. The flaw is classified as CWE-611 (Improper Restriction of XML External Entity Reference) and has been assigned the Cisco Bug ID CSCwv48590. The CVSS:3.1 score is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a high-impact vulnerability that can be exploited remotely without authentication.

Cisco has emphasized that this vulnerability has no available workarounds, making immediate upgrades essential for affected customers. The company's security vulnerability disclosure policy and transition to a risk-based model were also referenced in the advisory, highlighting their commitment to transparent security practices.