- Who should care: Service providers running Cisco BroadWorks for cloud calling, and anyone hosting Openwave Webtop webmail.
- What could go wrong: A stranger reads your server’s configuration files without ever logging in.
- Do this: Confirm every BroadWorks node runs RI.2026.07 and every Webtop Media Transcoder runs 1.1.22.0 or later.
- Worth remembering: Both fixes were already out. Attackers walked through the gap anyway.
Introduction
Two patches existed. Neither stopped the attacks. On Tuesday, CISA added a Cisco BroadWorks vulnerability and an Openwave webmail flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 24 to fix both.
What Happened?
The Cisco BroadWorks vulnerability, CVE-2026-20320, scores 7.5 on CVSS. It lives in the XML parser behind the BroadWorks Open Client Interface, which resolved external entities by default. Send one crafted XML message, no password required, and you can read sensitive files with the BroadWorks user’s privileges.
It hits the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. Cisco fixed it in RI.2026.07 on August 19, according to its security advisory. There is no workaround.
The Openwave bug, CVE-2026-111793, lets a logged-in user push blocked file types through Webtop Media Transcoder by going around the webmail front end.
A Patch From 2021, Still Sitting on the Shelf
Here is the part that stings. Openwave’s fix, version 1.1.22.0, shipped on December 6, 2021. The CVE wasn’t published until October 2026, and Japan’s JPCERT/CC reported observed attacks on November 9. So the servers getting hit have skipped an update for almost five years.
The CVSS score of 4.3 made it look like a chore for next quarter. Exploitation data now says otherwise. EPSS gives each bug well under 1% odds of attack in the next 30 days, and both are under attack today.
What’s the Impact?
This Cisco BroadWorks vulnerability matters because BroadWorks runs cloud calling for carriers, so its config files can expose credentials, internal hostnames, and integration details. That is a floor plan for the next break-in.
Cisco’s August advisory reported no exploitation, and nobody has said publicly how these attacks work or who is behind them. CISA confirmed active use in its November 10 alert.
How to Avoid This
To close the Cisco BroadWorks vulnerability and the Openwave gap, work through this list:
- Check the actual release on every BroadWorks node (not the install date) and upgrade to RI.2026.07
- Lock the Open Client Interface to trusted management hosts and known clients only
- Upgrade Webtop Media Transcoder to 1.1.22.0, or move to a supported Media Server 2.0 release
- Hunt for inbound XML carrying DOCTYPE or ENTITY declarations, plus odd outbound calls from BroadWorks servers
- Let KEV status set your patch order, whatever the CVSS score says
- Rotate secrets stored in BroadWorks config, since a patched server can still hold files an attacker already read
A Patch on the Shelf Protects Nobody
Both fixes existed before the attacks began. What failed was the step between “available” and “applied” on the systems attackers could actually reach.
- AI teammates attack your exposed services the way an adversary would, so a reachable Open Client Interface surfaces before someone else finds it
- New KEV entries get matched to the assets you actually run, so a 4.3 with live exploitation jumps the queue
- Hardening follows rules your team sets, with approvals wherever you want them
- Every fix gets retested and logged, so you can prove the patch landed instead of assuming it did
- Analysts stop chasing tickets by hand. No More Grunt Work. No More Burnout.
Attack. Harden. Prove. Repeat.
