CISA Adds Actively Exploited Cisco BroadWorks Flaw to KEV Must-Patch List

WASHINGTON — The Cybersecurity and Infrastructure Security Agency added an actively exploited vulnerability impacting Cisco BroadWorks application servers to its mandatory remediation catalog Wednesday morning. The flaw, cataloged as CVE-2026-20320 with a CVSS severity score of 7.5, allows unauthenticated remote attackers to extract sensitive configuration records across enterprise telecommunications networks. Under the statutory authority of Binding Operational Directive 22-01, federal civilian executive branch agencies must identify and patch all exposed appliances by November 24, 2026. Attackers weaponized the vulnerability prior to public disclosure. Federal compliance is mandatory.

Cisco BroadWorks serves as the digital backbone for major telecommunications carriers, routing unified communications, hosted private branch exchanges, and mobile voice services for millions of corporate subscribers worldwide. Exploitation targets the Open Client Interface — Provisioning subsystem, which processes administrative commands through XML-based network transactions on TCP ports 2208 and 2209. Threat actors transmit crafted XML documents containing malicious external entity references directly to exposed management gateways. The targeted server processes the malicious entity without validating administrative credentials. Sensitive system credentials leak immediately.

The catalog escalation follows independent threat intelligence reports detailing automated exploit reconnaissance against critical communications perimeters. Adversaries leverage compromised configuration files to harvest database authentication tokens, user directory listings, and cryptographic certificates. These intrusions parallel credential theft patterns analyzed in Homeland411’s ongoing investigation of zero-day authentication key extraction vectors across enterprise operating systems. When an edge gateway processes unauthenticated requests, internal corporate networks face immediate lateral compromise. Defense perimeters crumble rapidly.

Federal directives emphasize that vulnerabilities cataloged within the Known Exploited Vulnerabilities ledger represent proven, active attack paths rather than theoretical laboratory risks. The directive aligns with federal perimeter defense baselines examined in Homeland411’s analysis of federal perimeter security remediation mandates across civilian agencies. Federal executive leadership ordered civilian Chief Information Officers to accelerate local discovery audits and terminate perimeter connections to unpatched appliances. Time is running short.

Known Exploited Vulnerabilities Technical Specifications and Deadlines

Federal cybersecurity authorities established strict remediation thresholds for the newly cataloged Cisco vulnerability under Binding Operational Directive 22-01, mandating immediate enterprise inventory reconciliation across all civilian executive networks:

The underlying software defect stems from deficient XML parser configuration within the BroadWorks provisioning subsystem. According to official technical guidance published in the Cisco Security Advisory for BroadWorks OCI-P, the application fails to disable external entity resolution when parsing incoming provisioning requests. Remote attackers craft messages containing document type declarations that reference arbitrary local system files. When the server processes the incoming payload, it dereferences the file path and transmits the target file contents back to an external server controlled by the attacker. System defenders confirm that this out-of-band blind injection mechanism bypasses traditional web application firewalls lacking deep XML inspection capabilities.

Three Mandatory Enforcement Protocols Under Directive 22-01

To comply with federal cybersecurity standards defined under NIST SP 800-53 Security Controls, civilian executive departments and commercial telecommunications carriers must execute three prioritized defensive actions:

1. Apply Validated Vendor Patches: Upgrade all vulnerable Cisco BroadWorks clusters immediately to software release RI.2026.07 or later, ensuring software builds incorporate updated XML parsing libraries that permanently disable external DTD resolution.
2. Isolate Management Interfaces: Restrict all network connectivity to OCI-P provisioning interfaces on TCP ports 2208 and 2209, blocking public internet exposure and enforcing multi-factor authenticated virtual private network access.
3. Audit Access Telemetry for XXE Artifacts: Inspect server access logs for irregular POST requests directed at provisioning endpoints, searching for anomalous character encodings, outbound DNS callbacks, or external entity declarations.

Civilian agencies unable to deploy the required software hotfix before the November 24 deadline must immediately disconnect affected systems from the federal enterprise network backbone. Statutory regulations leave zero room for administrative discretion or operational waivers. Commercial telecom carriers must also audit secondary contractors to prevent supply chain compromises examined in Homeland411’s reporting on critical communications supply chain exposure across enterprise vendors. Unpatched appliances represent unacceptable corporate liability.

Threat Actor Exploitation and Telecom Carrier Exposure

Threat intelligence researchers tracking adversary tradecraft report that sophisticated state-sponsored espionage groups actively incorporate the BroadWorks exploit into automated attack frameworks. Telemetry confirms threat actors mapped exposed OCI-P services across North American and European telecommunications providers. The exploitation tradecraft maps to MITRE ATT&CK Technique T1190 for exploiting public-facing applications. Attackers seek root configuration files to map carrier call-routing topologies and intercept lawful interception records. Critical infrastructure operators face targeted espionage campaigns.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Given the active exploitation of this flaw, CISA strongly urges all organizations to reduce their exposure by prioritizing timely remediation.”

— Cybersecurity and Infrastructure Security Agency, Official Known Exploited Vulnerabilities Notice

Federal officials emphasize that the compromise of core telecommunications platforms jeopardizes enterprise confidentiality across interconnected government and commercial networks. When an adversary establishes persistence within a carrier’s voice routing core, traditional perimeter monitoring software fails to detect lateral reconnaissance. Agency leadership continues to brief commercial telecom executives on threat attribution and defensive telemetry indicators. National security depends on rapid patch execution.

Federal civilian executive agencies must submit automated completion certifications through CISA’s CyberScope portal by 23:59 UTC on November 24, 2026, confirming that all vulnerable Cisco BroadWorks instances have been patched or severed from public routing.