BroadWorks XML parser exploited, reads config (CVE-2026-20320)

Actively exploited in the wild - CVE-2026-20320 is a high-severity information disclosure flaw in Cisco BroadWorks’ Open Client Interface (OCI) XML Parser that lets unauthenticated, remote attackers read sensitive files from the host filesystem. Cisco has confirmed exploitation; apply the fixed software release or the mitigations below.

Overview

The Open Client Interface - Provisioning (OCI-P) service accepts XML messages from remote clients. In affected BroadWorks releases, the XML parser resolves external entities by default, so a crafted message can pull local files into the response. Because no credentials are required and no user interaction is needed, any host that can reach the OCI-P listener is a potential entry point.

The exposure is read-only but serious. An attacker can view files readable by the Cisco BroadWorks service account, which typically includes configuration data such as credentials for downstream systems, provisioning secrets, and network topology details. That material is exactly what an intruder needs to pivot deeper into a service provider or enterprise voice estate.

CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog, confirming real-world attacks. The EPSS score of roughly 0.4% suggests broad scanning is not yet widespread, but KEV status means targeted exploitation is happening. The gap between low EPSS and confirmed exploitation is a reminder that EPSS measures likelihood across the whole internet, not the risk to any specific internet-facing BroadWorks deployment.

Impact

Successful exploitation leaks local files with the privileges of the BroadWorks service user. Attackers can harvest configured credentials, internal hostnames, and integration secrets without authentication, laying groundwork for lateral movement against adjacent telephony and billing infrastructure.

Remediation and Mitigation

• Update to the Cisco fixed software release for your BroadWorks track. Check Cisco’s advisory for the specific version per release.
• If you cannot patch immediately, disable external entity resolution in the OCI-P XML parser, or restrict the OCI-P service to trusted management networks and IP allowlists.
• Rotate any credentials or secrets that appear in files readable by the BroadWorks user, since prior exploitation may already have exposed them.
• Hunt for anomalous OCI-P requests containing DOCTYPE or ENTITY declarations in logs and proxy telemetry.

Cisco patched flaws in this same OCI-P surface before, and the pattern is familiar to teams that tracked the Cisco SD-WAN auth bypass exploited to deploy KeyDrift and the Cisco ISE zero-day exploited, CVSS 10.0 auth bypass incidents.

Security Insight

XML external entity handling remains a recurring class of bug in telecom and provisioning stacks, where parsers are bolted onto legacy interfaces and default settings are never revisited. That this sat unauthenticated on a provisioning endpoint, and is now confirmed exploited, shows the reset of “listen on trusted networks” assumptions that drove earlier Cisco edge compromises, including the Cisco SD-WAN Manager auth bypass added to KEV. Operators should treat any reachable OCI-P listener as hostile until patched, much as defenders reassessed exposure after the University of San Francisco ransomware claim forced a hard look at identity and credential sprawl.

Further Reading

• Cisco SD-WAN auth bypass exploited to deploy KeyDrift
• Cisco SD-WAN Manager auth bypass exploited, CISA KEV
• Cisco ISE zero-day exploited, CVSS 10.0 auth bypass
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs