CISA’s November listing changes the urgency around a BroadWorks weakness patched in August. Cisco identifies fixed software and says no workaround addresses the vulnerability.
CISA added CVE-2026-20320, a Cisco BroadWorks vulnerability, to its Known Exploited Vulnerabilities catalogue on 10 November. The entry identifies a flaw that can expose sensitive configuration information to an unauthenticated remote attacker and sets a 24 November remediation due date in the federal catalogue.
The new listing is the significant development. Cisco had already published its security advisory on 19 August and released software addressing the issue. Evidence of exploitation changes the prioritisation of a known weakness; it does not make November the date the vulnerability was first disclosed.
Affected components and the available fix
Cisco attributes the problem to the Open Client Interface XML parser. Its advisory lists BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform when running vulnerable releases. The vendor rates the issue high severity, with a CVSS base score of 7.5.
The advisory identifies RI.2026.07 as the first fixed release for the listed components and states that no workaround addresses the vulnerability. Operators need to check the relevant product and release information against their actual deployments, including the platform-specific notes in Cisco’s table.
Disclosure history and current exposure
Cisco’s August advisory retains an exploitation section saying its response team was then unaware of malicious use. That statement belongs to the advisory’s publication history. It should be read alongside CISA’s later exploitation listing, rather than used to dismiss the newer warning.
The catalogue does not establish that every BroadWorks installation has been compromised, nor does it identify a responsible actor in this entry. Its value is narrower and operationally important: defenders have evidence that the weakness is being exploited and a vendor-defined update path to review.
For communications providers and organisations relying on managed services, the immediate question is whether the affected software is present and whether the fix has reached it. Closing a vulnerability-management ticket should follow verification of the deployed release, rather than the assumption that an available patch has already been installed.
Sources
CISA — Known Exploited Vulnerabilities catalogue, CVE-2026-20320
