Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 1.1.22.0 : patch affected systems soon.
Data as of 11 Nov 2026, 09:18 UTC
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.1.22.0
What to do
AI-suggested
Both vulnerabilities have official patches available. Openwave Webtop Media Transcoder patched CVE-2026-111793 in version 1.1.22.0 released in December 2021. Cisco BroadWorks patched CVE-2026-20320 in version RI.2026.07 of its Application Delivery Platform and related components. Organizations should apply these patches immediately. The U.S. CISA recommends patching these vulnerabilities by November 24, 2026. No alternative mitigations or workarounds are indicated in the vendor advisories.
Description
Two vulnerabilities, CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks, have been exploited by threat actors to leak sensitive information including configuration data. The Openwave flaw allows authenticated users to bypass file-type restrictions to convert unintended document types, potentially exposing sensitive data. The Cisco BroadWorks vulnerability is a remote, unauthenticated XML external entity injection that permits reading sensitive configuration information. Both vulnerabilities have been patched by their respective vendors. The U.S. CISA has added these flaws to its Known Exploited Vulnerabilities catalog and urges patching by November 24, 2026. Exploitation campaigns have targeted telecommunications providers and their customers, focusing on asset enumeration, credential theft, and subscriber data harvesting.