CISA Warns of Active Exploits Targeting Cisco BroadWorks Flaw

"This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.

Cisco's diagnosis: an XXE weakness in the OCI XML parser (CVE-2026-20320)

Cisco’s remediation and advisory trace the flaw to an improper restriction of XML External Entity (XXE) reference handling in the Open Client Interface (OCI) XML Parser used by BroadWorks. Tracked as CVE-2026-20320, the bug allows unauthenticated, remote attackers to read sensitive configuration information by sending maliciously crafted XML messages to the provisioning interface. Cisco described the vulnerability as arising from "external entity resolution being allowed by default," and said exploitation involves a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service.

CISA places CVE-2026-20320 on the KEV Catalog and sets a November 24 deadline for federal agencies

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) Catalog and flagged it as actively exploited. Under Binding Operational Directive (BOD) 26-04, CISA ordered Federal Civilian Executive Branch (FCEB) agencies to secure affected systems within two weeks — by November 24. While the directive applies only to FCEB agencies, CISA explicitly urged all security teams, including those in the private sector, to prioritize patching this flaw, calling such vulnerabilities "a frequent attack vector for malicious cyber actors" that "pose significant risks to the federal enterprise."

Malbear Labs: a Chinese‑speaking actor using a jailbroken AI model to exploit BroadWorks

Threat intelligence firm Malbear Labs reported that a Chinese‑speaking threat actor exploited CVE-2026-20320 in attacks against a European telecommunications provider and thirteen organizations that used that provider's data centers and cloud infrastructure. Malbear Labs said the attacker used a jailbroken DeepSeek Flash artificial intelligence model to assist exploitation, targeting the provider's BroadWorks XSP (eXtended Services Platform).

Observed effects: exposed provisioning, recovered keys, and unauthenticated filesystem reads

According to Malbear Labs, the BroadWorks Provisioning Server — which stores subscriber configuration for all users — was exposed via an unauthenticated directory listing. The attacker delivered a crafted OCI request to port 2208; the XXE in the OCI XML parser allowed the XML parser to read arbitrary files from the server filesystem with "no prior authentication required."

From the compromised XSP host, the agent reportedly recovered the system identity private key, three SSL credential sets, and three additional private keys with certificate matches confirmed. Malbear Labs noted that the "system identity key is used by the BroadWorks platform to authenticate between its own components; possessing it allows impersonation of the XSP in inter-component communication."

What this means for federal agencies, security teams, and telecom operators

• Federal agencies: The BOD 26-04 two‑week requirement sets a hard remediation window — systems identified as vulnerable must be secured by November 24. Agencies on the KEV Catalog list will be required to document and complete mitigations within the directive’s timeframe.
• Security teams and private-sector operators: CISA’s advisory urges organizations outside government to adopt "risk-based vulnerability management" and prioritize KEV Catalog flaws. For those running BroadWorks, the immediate actions are to apply Cisco’s August patch where available and audit OCI-P exposure, especially on port 2208 and any publicly reachable provisioning endpoints.
• Telecom providers and data center customers: The reported exploitation targeted a provider’s XSP and recovered platform-level credentials, raising the prospect of inter-component impersonation. Providers should verify the integrity of system identity keys and SSL credentials, assess whether provisioning servers are publicly listed or reachable without authentication, and investigate any signs of credential misuse.

Since November 2021, CISA has added 103 Cisco vulnerabilities to its KEV Catalog, seven of which CISA says have also been abused by ransomware gangs — a broader data point the agency released alongside this listing. In this instance, evidence from Malbear Labs links exploitation to an autonomous, AI-assisted workflow and to the exposure of provisioning assets that hold platform‑wide trust.

The immediate, verifiable facts are clear: Cisco patched CVE-2026-20320 in August; CISA declared it actively exploited and imposed a federal mitigation deadline of November 24; and Malbear Labs reported concrete compromises tied to a European telecom provider and its customers, including recovered private keys and SSL credentials. The coming days will show whether affected organizations meet CISA’s remediation timetable and whether additional incidents tied to this vulnerability surface.

Original report: Bleeping Computer — CISA flags Cisco BroadWorks flaw as actively exploited in attacks