SockAnalystCisco BroadWorks CVE-2026-20320: unauthenticated OCI-P XXE now exploited to steal server keys, added to CISA KEV
SockAnalyst · Security+ certified analyst.
What happened
CVE-2026-20320 is an out-of-band blind XML external entity (XXE) flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks, the calling platform used by telecom and voice providers. Cisco patched it on August 19, 2026 (CVSS 3.1 base 7.5): the parser resolves external entities by default, so an unauthenticated attacker who sends a crafted XML message to the OCI-P provisioning service can read files with the BroadWorks user's privileges. Cisco lists no workaround. On November 10, 2026 CISA added it to the KEV catalog with a federal due date of November 24. BleepingComputer reports that Malbear Labs described an intrusion at a European telecom provider where the flaw, reached on OCI port 2208 of an Xtended Services Platform host, was used to recover the system identity private key and other SSL credentials and keys.
Who's affected
Carriers and service providers running BroadWorks Application Delivery Platform, Application Server, Profile Server or Xtended Services Platform earlier than RI.2026.07, especially where the OCI-P interface is reachable from untrusted networks.
✅ Fix / patch
- Upgrade BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform to RI.2026.07 or later; Cisco says there is no workaround.
- Restrict the OCI-P provisioning interface to known management and OSS/BSS source IPs only.
- If an unpatched server was reachable, treat its private keys, certificates and stored passwords as exposed: rotate the system identity key, SSL certificates and service credentials.
- Review exposed directory listings on the Provisioning Server and close them.
🔎 Quick hunt check
Cisco and CISA published no IOCs, and we did not verify indicators from the third-party research, so none are listed. Hunt for connections to OCI-P (TCP 2208 per the reported intrusion) from sources outside your provisioning allowlist, OCI requests containing DOCTYPE or ENTITY declarations, and unexpected outbound HTTP/FTP/DNS from BroadWorks hosts, which is how out-of-band blind XXE exfiltrates file contents.
MITRE ATT&CK: T1190, T1005, T1552.004, T1048
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
(index=network OR index=firewall) dest_port=2208
| lookup oci_allowlist src_ip OUTPUT allowed
| where isnull(allowed)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip
| append [ search index=broadworks (sourcetype=*oci* OR source=*OCI*) ("<!DOCTYPE" OR "<!ENTITY" OR "SYSTEM \"") | stats count values(src_ip) as src by host ]
| append [ search (index=network OR index=firewall) src_ip IN (BROADWORKS_HOST_IPS) dest_port IN (21,80,443,8080) action=allowed NOT dest_ip IN (KNOWN_UPDATE_IPS) | stats count values(dest_ip) as dest by src_ip ]
// CVE-2026-20320: non-allowlisted OCI-P clients, XXE payload markers, and outbound exfil from BroadWorks hosts (replace placeholders with your lists)let BroadWorksHosts = dynamic(["10.0.0.10"]); // replace with your BroadWorks server IPs
let OciAllow = dynamic(["10.0.1.0/24"]); // replace with provisioning client ranges
union
(CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationPort == 2208
| where not(ipv4_is_in_any_range(SourceIP, OciAllow))
| summarize Hits=count(), First=min(TimeGenerated) by SourceIP, DestinationIP, Detail="Non-allowlisted OCI-P client"),
(CommonSecurityLog
| where TimeGenerated > ago(30d)
| where SourceIP in (BroadWorksHosts) and DestinationPort in (21, 80, 443, 8080)
| where not(ipv4_is_private(DestinationIP))
| summarize Hits=count(), First=min(TimeGenerated) by SourceIP, DestinationIP, Detail="BroadWorks host outbound to internet (possible OOB XXE)")
// CVE-2026-20320 Cisco BroadWorks OCI XXE exposure and exfil hunt⏱ CISA deadline
Sources
- Cisco Security Advisory cisco-sa-bworks-xxe-uwUd7CEt: BroadWorks Out-of-Band Blind XXE (CVE-2026-20320)
- CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)
- BleepingComputer: CISA flags Cisco BroadWorks flaw as actively exploited in attacks
- SecurityWeek: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
Related playbooks
- Xen Orchestra VSA-2026-062: empty-object login cookie gives attackers admin and root on XCP-ng hosts, exploited in the wild · Exploited vuln · 2026-11-11
- Barracuda ESG: pre-auth admin bypass chained to root command injection, now exploited · Exploited vuln · 2026-11-10
- SignalWire FreeSWITCH CVE-2026-116779: one SIP MESSAGE can run FreeSWITCH API and OS commands, exploited in the wild · Exploited vuln · 2026-11-10
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free