Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

Ravie LakshmananNov 11, 2026Vulnerability / Enterprise Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

Details of the vulnerabilities are below -

• CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity reference vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system with the privileges of the Cisco BroadWorks user. (Fixed in August 2026)
• CVE-2026-111793 (CVSS score: 4.3) - An incorrect resource transfer between spheres vulnerability in Openwave Messaging Webtop Media Transcoder that could allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. (Fixed in October 2026)

There are currently no details on how the vulnerabilities are being exploited in real-world attacks, nor have they been attributed to a specific named threat actor or group. Cisco's advisory also makes no mention of the flaw being maliciously used.

Late last month, Cisco revealed that two different vulnerabilities in Catalyst SD-WAN (CVE-2026-20127, CVSS score: 10.0) Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software (CVE-2026-76418, CVSS score: 8.6) have been actively exploited in the wild.

In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 24, 2026, to secure their networks.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.