CISA Adds Cisco BroadWorks Vulnerability to KEV List Amid Exploitation Reports

## Overview CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) list on November 10, 2026. This vulnerability affects the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. It allows unauthenticated, remote attackers to read sensitive configuration information. ## Technical Details The vulnerability arises from improper parsing of XML entries. External entity resolution is enabled by default, which can be exploited. An attacker can send a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. This action could allow the attacker to access sensitive files from the filesystem with the privileges of the Cisco BroadWorks user. ## Impact Successful exploitation of this vulnerability can lead to unauthorized access to sensitive configuration data. The potential for exploitation has been highlighted by reports from multiple sources, indicating that the flaws are actively being targeted despite available patches. CISA's addition of this CVE to the KEV list underscores the urgency of addressing this issue, especially given recent exploitation evidence. ## Mitigation Organizations using Cisco BroadWorks should apply the latest patches as soon as possible. Regularly review security updates from Cisco and monitor systems for any signs of unauthorized access. Implementing strict input validation and disabling external entity resolution can also help mitigate the risk.