The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026, citing evidence of active exploitation. The agency’s alert raises the priority of installing available fixes: the BroadWorks flaw can expose sensitive files without a login, while the Openwave flaw lets an authenticated user process document types outside the intended workflow.
Organizations running BroadWorks Application Delivery Platform, Application Server, Profile Server or Xtended Services Platform should check their releases. Cisco says those products are affected when running vulnerable software, regardless of device configuration. Openwave Webtop Media Transcoder administrators also need to review their patch status; The Hacker News reports that its vulnerability was fixed in October 2026.
BroadWorks exposes files through crafted XML
The BroadWorks vulnerability, CVE-2026-20320, has a reported Common Vulnerability Scoring System (CVSS) severity score of 7.5. It affects the Open Client Interface (OCI) XML parser, the component that interprets structured XML messages.
In its security advisory, Cisco explains that the parser allows external entity resolution by default. That feature lets an XML message refer to resources outside the message itself. An unauthenticated remote attacker can send a crafted XML message to the Open Client Interface–Provisioning (OCI-P) service and potentially read sensitive files with the privileges of the Cisco BroadWorks user. Sensitive configuration information is one example of what could be exposed.
Cisco initially published the advisory on August 19, 2026, and credited Sandesh M Gawai with reporting the vulnerability. Its advisory says the company’s Product Security Incident Response Team was unaware of public announcements or malicious use, while CISA’s subsequent catalog addition cites evidence of active exploitation.
Openwave flaw requires an authenticated user
CVE-2026-111793, the Openwave Messaging Webtop Media Transcoder vulnerability, has a reported CVSS score of 4.3. The Hacker News reports that an authenticated user who bypasses the Webmail experience can make the transcoder process and convert unintended document types. The flaw is classified as an incorrect resource transfer between spheres, meaning a resource crosses a boundary improperly.
The report says neither vulnerability’s real-world attack methods have been detailed publicly or attributed to a named threat actor or group.
The two flaws were part of six additions in CISA’s November 10 alert. The others were CVE-2026-111560, an operating-system command injection vulnerability in multiple Barracuda Networks products; CVE-2026-116606, an authentication bypass through an alternate path or channel in Barracuda Email Security Gateway; CVE-2026-124194, a Microsoft Outlook flaw involving a potentially unsafe action without user interaction; and CVE-2026-125350, a Google Chromium use-after-free flaw involving memory after it has been released.
The additions follow Cisco’s disclosure late last month of active exploitation affecting Catalyst SD-WAN, CVE-2026-20127, and Secure Firewall ASA and FTD software, CVE-2026-76418, The Hacker News reported.
Install the fixes for the affected products
Cisco identifies RI.2026.07 as the first fixed release for BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform, with earlier releases listed as vulnerable. The Application Delivery Platform entry specifically names Open Client Server (OCS) and OCIOverSoap. Cisco says there are no workarounds and strongly recommends upgrading to the appropriate fixed release.
Customers who cannot obtain the fixed software through their normal purchasing or support channel can contact Cisco’s Technical Assistance Center with the product serial number and advisory URL. Cisco also advises checking hardware capacity and continued configuration support before upgrading.
The Hacker News reports a November 24, 2026 patch date for U.S. Federal Civilian Executive Branch agencies. That date is specific to those agencies. CISA says Binding Operational Directive 26-04 establishes risk-based remediation requirements for them, including expectations for checking whether a system was compromised before patching. CISA encourages all organizations to prioritize remediation of vulnerabilities in the KEV catalog.
