CVE-2026-20320 — an XML external entity flaw in Cisco BroadWorks — and CVE-2026-111793 in Openwave Messaging were added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog this week after evidence that both are being used in real-world attacks.
CISA adds two vulnerabilities to the KEV catalog after evidence of active exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday placed two vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder onto its Known Exploited Vulnerabilities (KEV) list, citing evidence that both flaws are actively exploited. The agency’s action follows vendor advisories and aligns with CISA’s practice of urging rapid mitigation in the face of exploitation. The bulletin notes there are currently no public details on the methods used in those attacks, and neither attribution nor a named threat actor has been provided.
Technical outline: what the two CVEs do
The two entries are distinct in mechanism and impact:
- CVE-2026-20320 (CVSS score: 7.5) — An improper restriction of XML external entity (XXE) reference vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. The vulnerability could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system with the privileges of the Cisco BroadWorks user. According to the advisory, this vulnerability was fixed in August 2026.
- CVE-2026-111793 (CVSS score: 4.3) — An incorrect resource transfer between spheres vulnerability in Openwave Messaging Webtop Media Transcoder. This flaw could allow an authenticated user to process and convert unintended document types if they bypass the Webmail experience. The advisory states this issue was fixed in October 2026.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPatch history, vendor messaging, and recent related incidents
Both vulnerabilities already have vendor fixes: Cisco’s BroadWorks fix was released in August 2026 and Openwave’s Webtop Media Transcoder fix arrived in October 2026. The source notes that Cisco’s advisory does not describe malicious use of the BroadWorks vulnerability, and there are no published details describing the exploitation techniques used in the field for either flaw.
The KEV additions come shortly after Cisco reported, late last month, that two other vulnerabilities were being actively exploited: CVE-2026-20127 in Catalyst SD‑WAN (CVSS score: 10.0) and CVE-2026-76418 in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software (CVSS score: 8.6). The proximity of these disclosures underscores a cluster of high-profile Cisco-related issues being observed this fall.
What this means for Federal Civilian Executive Branch agencies, security teams, and affected enterprises
- Federal Civilian Executive Branch (FCEB) agencies — CISA recommends applying the available patches by November 24, 2026, to secure their networks. That deadline is explicit and short; agencies will need to inventory affected assets and schedule prioritized deployments to comply.
- Technologists and security operations teams — Teams responsible for BroadWorks and Openwave installations must verify patch status, confirm that August and October updates were applied, and monitor for unusual access to configuration files or unexpected document conversions that could indicate exploitation.
- Affected enterprises and procurement leaders — Organizations using the named products should confirm vendor patch deployment, update change control and incident response playbooks to reflect these CVEs, and note that vendor advisories to date do not include public exploitation details or actor attribution.
Immediate next steps and unanswered operational questions
The practical next step remains straightforward: apply the vendor-provided fixes. Beyond patching, defenders must contend with two clear unknowns recorded in the advisories — how the vulnerabilities are being exploited in real-world attacks, and who is responsible. The advisories and CISA’s KEV entry document evidence of exploitation but offer no technical indicators or attribution to guide hunting and response.
That gap leaves incident responders with a narrower playbook: ensure systems are patched to the August and October releases, harden monitoring around the affected components, and treat related anomalous activity as potentially linked to the identified CVEs until investigators publish more detail.
Active exploitation despite available fixes is the central fact here: both vulnerabilities had patches available before CISA added them to KEV. The only clear lever for defenders is speed — inventory, patch, and validate — while the broader investigative work to explain who exploited these flaws and how remains to be published.
