Cisco and Openwave BroadWorks Flaws Exploited; CVE-2026-20320 in KEV

En bref

• A pair of flaws affects Cisco BroadWorks and Openwave Webtop Media Transcoder.
• CVE-2026-20320 is tied to an XML external entity restriction weakness.
• Exploitation is ongoing, and the issue entered the KEV catalog on a Tuesday in November 2026.
• Vendor fixes are available; affected organizations should patch urgently.

A pair of security defects affecting Cisco BroadWorks and Openwave Webtop Media Transcoder is now under active attack, according to a Tuesday update that placed one issue in the Known Exploited Vulnerabilities catalog. The tracked flaw is CVE-2026-20320, described as an XML external entity restriction weakness. Vendor fixes are already available.

The exposure matters because BroadWorks supports enterprise communications, and Webtop Media Transcoder handles media processing; compromise could disrupt voice services or expose sensitive data. Districts using these components, directly or through a service provider, should confirm whether affected versions are in use.

The November 2026 KEV entry signals confirmed exploitation, not a theoretical risk. Once a flaw is in KEV, federal agencies face remediation deadlines, and state and local organizations, including K-12, should treat the timeline as a minimum. The second vulnerability in the pair should be reviewed alongside CVE-2026-20320 even though only one CVE is named here.

Attackers often target XML parsers to read local files, reach internal services, or bypass access controls. An XXE restriction bypass can undermine protections meant to block external entity resolution. Watch for unusual XML requests, outbound connections from application servers, and errors tied to media or web endpoints.

What to watch: vendor advisories for both products, updated KEV guidance, and any exploitation reports from sector peers. Patching is the durable fix; compensating controls should be temporary.

À faire maintenant

1. Inventory all Cisco BroadWorks and Openwave Webtop Media Transcoder deployments, including provider-managed instances, and flag internet-facing systems.
2. Apply the vendor patches for CVE-2026-20320 and the related flaw immediately; schedule emergency change windows if needed.
3. If patching cannot happen at once, disable or restrict XML external entity processing and block unnecessary outbound traffic from affected servers.
4. Review web and application logs for malformed XML, unexpected entity references, and outbound connections from BroadWorks or Webtop hosts.
5. Limit administrative and network access to affected components; enforce least privilege and segment media and voice systems from general IT networks.
6. Track KEV deadlines and vendor advisories; document exceptions and set a firm remediation date for any remaining instances.
7. Brief service providers and telecom teams so they confirm patched versions and share exploitation indicators.

Références CVE

• CVE-2026-20320

Source originale

The Hacker News