Cisco BroadWorks XXE Now Actively Exploited in Attacks

CISA has identified a high-severity XXE vulnerability in Cisco BroadWorks as actively exploited in real-world attacks. The flaw (CVE-2026-20320) resides in the platform’s OCI XML parser and permits unauthenticated remote attackers to extract sensitive configuration data by transmitting crafted XML requests. BroadWorks is a critical component for telecommunications carriers and managed service providers delivering cloud-based voice and collaboration services to business customers. The agency mandated that federal agencies patch the vulnerability within two weeks, while encouraging private-sector organizations to prioritize remediation.

Threat researchers from Malbear Labs documented exploitation of CVE-2026-20320 by a Chinese-speaking actor using a modified DeepSeek Flash AI system. The attack targeted a European telecommunications provider and thirteen downstream organizations that relied on its infrastructure. The attacker compromised the BroadWorks Provisioning Server, recovering the system identity key—a credential that enables cross-component authentication impersonation within the platform. Additional SSL certificates and private keys were also extracted through an unauthenticated directory listing.

Cisco vulnerabilities have emerged as a recurring target in critical infrastructure. Since late 2021, CISA cataloged 103 Cisco flaws as actively exploited, with at least seven abused by ransomware operations.