Search: CVE-2026-20320

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Two vulnerabilities, CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks, have been exploited by threat actors to leak sensitive information including configuration data. The Openwave flaw allows authenticated users to bypass file-type restrictions to convert unintended document types, potentially exposing sensitive data. The Cisco BroadWorks vulnerability is a remote, unauthenticated XML external entity injection that permits reading sensitive configuration information. Both vulnerabilities have been patched by their respective vendors. The U.S. CISA has added these flaws to its Known Exploited Vulnerabilities catalog and urges patching by November 24, 2026. Exploitation campaigns have targeted telecommunications providers and their customers, focusing on asset enumeration, credential theft, and subscriber data harvesting.