Cisco BroadWorks CVE-2026-20320 Is Now Listed as Exploited, Three Months After the Fix. Cisco Says It Knows of No Attacks; the Attack Report Comes From Malbear Labs
If you run Cisco BroadWorks, confirm you are on release RI.2026.07 or later. Cisco published the fix on August 19, and on November 10 CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog with a federal deadline of Tuesday, November 24. Cisco says there is no workaround, so the update is the only fix. A second flaw, in an Openwave email product, went into the same catalog the same day.
What has been reported
The primary sources are Cisco's advisory and Openwave's advisory, which an agent read for us, and The Hacker News report of November 11. The catalog dates come from The Hacker News, which links CISA's alert. We did not read the CISA alert or the Malbear Labs report, and the attack account below is Malbear's as relayed by The Hacker News.
- The flaw: per Cisco's advisory, BroadWorks parses XML messages with external entity resolution allowed by default. A crafted XML message sent to the OCI-P service by someone with no login can make the server read sensitive configuration information, with the privileges of the BroadWorks user. Severity is High, 7.5 out of 10. Affected: the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. Fixed in RI.2026.07. The advisory's table prints the fixed release inconsistently for the Application Delivery Platform ("earlier than RI.2026.071"), so check Cisco's table for your product. Cisco states there is no workaround.
- What Cisco says about attacks: the copy of the advisory we read is version 1.0, and says Cisco "is not aware of any public announcements or malicious use." That conflicts with CISA's listing. Either our copy is stale or Cisco has not updated it. We cannot tell which.
- Who says it is exploited: The Hacker News cites Malbear Labs, which calls the campaign Operation Snowball. Per that account, an unknown Chinese-speaking attacker used an automated framework built on a jailbroken DeepSeek Flash model to exploit CVE-2026-20320 against a European telecom and 13 companies hosted on its infrastructure. Malbear names Sliver, Chisel and Behinder web shells as tools. Malbear's fingerprint for the targeted system is a BroadWorks XSP running release 23.0.1.1075 and listening on port 2208. No IP addresses, domains or file hashes are given.
- The Openwave flaw, CVE-2026-111793: a Webtop Media Transcoder issue scored 4.3 out of 10. Openwave's advisory says the transcoder does not enforce the administrator's file-type restrictions, in versions before 1.1.22.0, and says nothing about attacks. The Hacker News says a Japanese vulnerability note reports the developer has seen attacks, and that is the basis for the catalog listing. We did not read that note. Dates in the two sources conflict: The Hacker News says fixed in October 2026, while Openwave lists the fixed version as released in December 2021 and a disclosure date of October 7, 2026.
What it means
BroadWorks is the phone-system software carriers and large companies run to deliver calling and messaging. Configuration it holds can include credentials, so reading it is a stepping stone, not just an information leak. The long gap between fix and listing is the lesson: a flaw patched in August was still reachable by an attacker in November, which means telecom operators were not patching on the vendor's clock.
What to do
- Check your BroadWorks release on every server of the four types above and update to RI.2026.07 or later.
- Do not leave the OCI-P service reachable from the internet. Restrict it to the systems that need it.
- If a BroadWorks server was exposed and unpatched, treat the configuration it holds as read: rotate credentials stored in it, and look for the tools Malbear names, Sliver, Chisel and Behinder web shells, on the server.
- If you run the Openwave transcoder, update to the latest supported Media Server 2.0 release per Openwave's advisory.
What is not known
Whether attacks beyond Malbear's one report exist, and whether Cisco will update its advisory. Whether the framework description (an automated attacker on a jailbroken model) is accurate; it is Malbear's claim and we did not see their evidence. Whether any public exploit code exists: our exploit harvester logged no repository under either CVE identifier as of this writing, which covers only repositories named for a CVE.
How we know, and how we checked
We read Cisco's and Openwave's advisories and The Hacker News through agents. We tested nothing. Our edge check cannot see this: BroadWorks speaks to a dedicated service port, not a web path our tool can match, and we run no BroadWorks. We add no indicators to our feed: the sources publish a software version and port, which are not indicators of compromise.
Sources
Cisco Security Advisory cisco-sa-bworks-xxe-uwUd7CEt, first published August 19, 2026. Openwave advisory CAN-2026-2032674. The Hacker News, "Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches," November 11, 2026, citing Malbear Labs and CISA.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.