CVE-2026-20320: Cisco BroadWorks OCI-P Blind XXE Lets Unauthenticated Attackers Read Configuration Files

Background

Product context below is our own summary, not from the advisory. Cisco BroadWorks is a carrier-grade voice and unified-communications platform used by service providers to deliver hosted telephony. The Open Client Interface - Provisioning (OCI-P) is the XML-based service that provisioning systems and portals use to configure BroadWorks. The advisory says the flaw affects four products “regardless of device configuration”: BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform.

CVE-2026-20320 is an out-of-band blind XML external entity (XXE) injection in the OCI-P XML parser. Cisco published its advisory (cisco-sa-bworks-xxe-uwUd7CEt) on 19 August 2026. CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog on 10 November 2026.

Technical Mechanism

Cisco states the XML parser resolves external entities by default (CWE-611). An unauthenticated remote attacker sends a crafted XML message to the OCI-P service. The parser resolves the attacker’s entity declaration, which lets the attacker read files from the filesystem with the privileges of the BroadWorks user. Cisco describes the result as disclosure of “sensitive configuration information”.

Cisco titles the issue “Out-of-Band Blind XML External Entity Injection”. Out-of-band XXE generally sends file content to an attacker-controlled location rather than returning it in the response; Cisco does not publish payload details. Malbear describes a crafted OCI request to port 2208 on an XSP.

The CNA (Cisco) scores it CVSS 3.1 7.5 High, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: network, low complexity, no privileges, no user interaction, high confidentiality impact only. NVD displays the Cisco CNA score; as of 2026-11-11 NVD has not published its own.

Real-World Exploitation Evidence

• Malbear Labs (third-party research, 8 November 2026): in “Operation Snowball”, Malbear describes an autonomous AI intrusion harness whose exposed workspace documented more than two weeks of activity by a Chinese-speaking operator against a European telecommunications provider. Malbear says the agent exploited CVE-2026-20320 against a BroadWorks XSP (release 23.0.1.1075, port 2208) with a crafted OCI request and no authentication, and that this was the entry point into the provider’s network. From the XSP host it recovered the system identity private key, three SSL credential sets and three further private keys. Malbear names no threat group; the operator description rests on the language of the recovered transcripts. This is a single vendor’s account of one campaign, and we have not independently verified it.
• CISA KEV: added 10 November 2026, due date 24 November 2026. The CISA-ADP container in the CVE record references the Malbear post and records (timestamp 2026-11-10) an SSVC “Exploitation: active” and “Automatable: yes” assessment. The KEV entry lists knownRansomwareCampaignUse: Unknown and names no actor.
• Cisco PSIRT: the advisory (revision 1.0, 19 August 2026) says PSIRT “is not aware of any public announcements or malicious use”. That statement predates the KEV listing and the Malbear post, and we did not find a revised advisory.
• Attribution and exploit code: no evidence found as of 2026-11-11 in the Cisco advisory, the KEV entry, the CVE record or the Malbear post of a named threat group. No public proof-of-concept was found in those sources or in a GitHub repository search for the CVE ID on 2026-11-11.

Impact Assessment

The attacker reads files readable by the BroadWorks service account. Cisco says this is configuration data. In the campaign Malbear describes, the files read from an XSP included the platform’s system identity private key and SSL credential sets; Malbear says the identity key authenticates BroadWorks components to each other, so possessing it allows impersonating the XSP. What is exposed in other deployments depends on the files present; Cisco does not list them. The CVSS vector scores no integrity or availability impact.

Exposure depends on whether OCI-P is reachable by untrusted networks. Cisco does not state a default exposure, so check your own network paths to the OCI-P service. Service providers and enterprises running BroadWorks are the affected population.

Affected Versions

The CVE record lists the product as “BroadWorks”, version “N/A”; the version boundaries above come from the Cisco advisory.

Remediation Steps

1. Upgrade all four BroadWorks components to RI.2026.07 or later. Cisco says there are no workarounds.
2. Complete the upgrade by the CISA due date of 24 November 2026 if you are a U.S. federal agency; others should treat that as a reference deadline.
3. Until patched, restrict network access to the OCI-P service to known provisioning systems. This is general hardening, not a Cisco-listed mitigation.
4. Given the exploitation reports, assume files readable by the BroadWorks user may have been read on any exposed unpatched system: rotate the system identity key and SSL credentials stored on it. This is our recommendation, not Cisco guidance.

Detection Guidance

The Cisco advisory lists no indicators of compromise. Practical checks, all our suggestions:

• Review OCI-P service logs for XML requests containing <!DOCTYPE or <!ENTITY declarations, which legitimate provisioning clients rarely send.
• Look for outbound connections from BroadWorks servers to unfamiliar external hosts, which is how out-of-band XXE exfiltrates data.
• Check which hosts can reach the OCI-P port from outside your provisioning network.

Timeline

References

• Cisco Security Advisory: cisco-sa-bworks-xxe-uwUd7CEt
• CVE record: CVE-2026-20320
• NVD: CVE-2026-20320
• Malbear Labs: Operation Snowball
• CISA Known Exploited Vulnerabilities Catalog