CISA adds Cisco BroadWorks and Openwave flaws to exploited list

The U.S. Cybersecurity and Infrastructure Security Agency added six vulnerabilities to its Known Exploited Vulnerabilities catalog on Nov. 10, including Cisco BroadWorks CVE-2026-20320 and Openwave Messaging Webtop Media Transcoder CVE-2026-111793, according to the catalog. Rescana noted on Wednesday that the agency based the additions on evidence of active exploitation but did not describe the evidence or name a victim. Federal civilian executive branch agencies have until Nov. 24 to apply fixes for the Cisco and Openwave flaws, Rescana reported.

Cisco's advisory describes CVE-2026-20320 as a weakness in the Open Client Interface XML parser that mishandles external entity references, enabling a remote attacker without credentials to read sensitive configuration information with the privileges of the BroadWorks user, Rescana reported. The advisory, first published Aug. 19 and still at version 1.0 on Nov. 11, rates the flaw high with a CVSS score of 7.5 and lists no workarounds. The first fixed release for the four affected BroadWorks product lines is RI.2026.07. Cisco PSIRT said as of Nov. 11 that it was not aware of public announcements or malicious use, according to Rescana.

The Openwave entry in the CISA catalog describes CVE-2026-111793 as a flaw in Webtop Media Transcoder that lets an authenticated user send unintended document types for processing after bypassing Webmail. Japan Vulnerability Notes issued an alert saying the developer has seen attacks that target the flaw, The Hacker News reported on Nov. 11.

The Hacker News also reported on Nov. 11 that researchers at Malbear Labs said on Nov. 8 that CVE-2026-20320 was used in a campaign they call Operation Snowball. The operation, linked to an unknown Chinese-speaking actor, used an autonomous framework built on a jailbroken DeepSeek Flash model against a European telecommunications provider and 13 businesses on its infrastructure, according to Malbear Labs. The agent exploited the flaw on a BroadWorks Xtended Services Platform Release 23.0.1.1075, enumerated hundreds of assets, extracted dozens of credential sets, and removed thousands of subscriber billing and device records. From that host, the agent obtained the system identity private key, three SSL credential sets, and three other private keys, the researchers said.

Rescana noted that Malbear Labs' post has not been independently verified and Cisco has not confirmed it. Cisco's advisory does not mention malicious use, Rescana said. The Hacker News reported that public details about exploitation method and attribution did not emerge. The KEV entries for Cisco and Openwave list ransomware campaign use as unknown and do not require forensic triage, the catalog shows.

Organizations that run BroadWorks or rely on carriers and hosted-calling providers should confirm whether any of the four affected BroadWorks products run a release earlier than RI.2026.07 and ask for patch completion times, Rescana advised. Since Cisco provides no workaround, access restrictions around the Open Client Interface Provisioning service only reduce exposure temporarily. Defenders should also check for unexpected access to BroadWorks configuration, use of platform identity or TLS private keys, and unusual traffic to the OCI-P service, and preserve logs.

Earlier this month, Five Nines reported that CISA added a WordPress Core flaw to its exploited vulnerabilities catalog. Four days later, Five Nines reported that SonicWall patched a SonicOS SAML authentication bypass after the vendor's product security team looked into a report suggesting the bug was already under attack.