Actively Exploited Cisco BroadWorks Flaw and Critical Apache HTTP/2 RCE Demand Immediate Action

Cisco BroadWorks CVE-2026-20320 actively exploited; critical Apache HTTP/2 and Siemens PHP2Shell flaws require urgent patching.

  • CISA added Cisco BroadWorks CVE-2026-20320 and a related Openwave Webtop Media Transcoder flaw to its KEV catalog, citing active exploitation; patches are reported available.
  • Apache HTTP Server CVE-2026-119618 is a critical unauthenticated RCE in mod_http2 affecting 2.4.55–2.4.70 and fixed in 2.4.71 when HTTP/2 is enabled.
  • CISA ICS advisories link PHP2Shell CVE-2026-109618/109619 to Siemens RUGGEDCOM APE1808 and building/energy products; hosted voice, web, and OT dependencies need immediate inventory and vendor confirmation.

What to do now

  1. Today, assign owners and inventory every Cisco BroadWorks and Openwave Webtop Media Transcoder deployment, including provider-managed/hosted voice; every Apache 2.4.55–2.4.70 instance with HTTP/2, including reverse proxies, load balancers, containers, and managed hosting; and every Siemens RUGGEDCOM APE1808 or building/energy asset with PHP runtime exposure.
  2. Apply vendor fixes immediately: Cisco/Openwave patches for CVE-2026-20320 and the related flaw; Apache 2.4.71 for CVE-2026-119618; Siemens/PHP fixes or documented workarounds for CVE-2026-109618/109619. If patching cannot happen now, disable HTTP/2 on Apache and apply vendor-approved compensating controls.
  3. Remove direct internet exposure from administrative interfaces and OT/building systems; require VPN and MFA for admin access; segment voice/media and facilities networks from user and general IT networks; restrict unnecessary outbound traffic.
  4. Hunt logs for malformed XML/entity references, anomalous HTTP/2 requests, server crashes, unexpected child processes, authentication/configuration changes, and outbound connections from BroadWorks, Apache, or Siemens hosts; preserve evidence and rotate credentials if compromise is suspected.
  5. Get written confirmation from service providers and OT vendors with patch versions and dates; track CISA KEV and vendor advisory deadlines; document exceptions with a firm remediation date; re-scan and re-verify after patching.

Related items