Federal cyber agency warns hackers are actively exploiting Cisco BroadWorks software

The Cybersecurity and Infrastructure Security Agency warned on Tuesday that attackers are actively exploiting a high-severity flaw in Cisco BroadWorks cloud communications software. Tracked as CVE-2026-20320, the vulnerability allows remote, unauthenticated attackers to steal sensitive configuration data from vulnerable telecommunications platforms. CISA added the bug to its Known Exploited Vulnerabilities Catalog, directing federal civilian agencies to patch their systems by November 24. [1][2]

The vulnerability stems from improper restriction within the Open Client Interface XML parser, which enabled external entity resolution by default before Cisco issued a patch in August. Malicious actors can read arbitrary files from a server filesystem without logging in simply by sending a crafted XML request to port 2208. Security firm Malbear Labs reported that a Chinese-speaking threat actor leveraged the flaw alongside a jailbroken DeepSeek Flash artificial intelligence model to compromise a European telecommunications provider and thirteen affiliated organizations. [1]