The Cybersecurity and Infrastructure Security Agency (CISA) on Nov. 10 added a Cisco BroadWorks flaw to its known exploited vulnerabilities (KEV) catalog.
CISA said the CVSS 7.5 flaw — CVE-2026-20320 — was an improper restriction of XML external entity reference vulnerability that could let an unauthenticated, remote attacker read sensitive files with the privileges of a Cisco BroadWorks user.
Security pros said teams should patch right away because major telecoms and managed service providers (MSPs) use CiscoBroadworks to manage their enterprise phone systems.
“BroadWorks is not simply another enterprise application,” said Agnidipta Sarkar, chief evangelist at ColorTokens. “It supports communications services delivered to multiple organizations, which creates a potential concentration of risk: one compromised service platform can expose information belonging to several customers.”
Melvin Lammerts, co-founder and head of hacking at Hadrian, pointed out that Cisco patched this BroadWorks flaw in August — and attackers are now exploiting it on systems that never got that update. The attack works without a login, so Lammerts said anyone on the internet can launch an attack.
Here’s how it works: an attacker sends a malicious (XML) message to the provisioning service, and BroadWorks reads files its own users can see. Those files can include sensitive information such as configurations and credentials.
“BroadWorks is the software telecom providers and MSPs use to deliver business phone service under their own brand,” said Lammerts. “Their customers’ phone service runs on those systems. A file read there reaches the platform those companies share. Providers still on an older release should install RI.2026.07 and rotate any credentials that might have been exposed."
Darin Fredde, senior director and offensive security evangelist at Ridge Security, added that telecom providers and managed service providers use Cisco BroadWorks to deliver hosted phone systems, calling, and collaboration services to large numbers of business customers.
“That makes vulnerabilities in the platform particularly concerning because the exposure may extend beyond a single organization,” said Fredde.
The important distinction with CVE-2026-20320 is that it’s an information-disclosure vulnerability, not a demonstrated takeover of the communications platform: an unauthenticated attacker can potentially retrieve sensitive configuration files through the provisioning interface. Depending on what those files contain, that information could help an attacker understand the environment or identify opportunities for additional attacks.
Fredde said CISA's confirmation of active exploitation changes the urgency: providers should identify affected deployments, apply Cisco's updates, restrict access to provisioning interfaces where possible, and investigate potential exposure. For a platform serving multiple customers, the security boundary is only as strong as the systems and interfaces protecting it.
“We should not confuse a 7.5 severity score with a 7.5 level of urgency,” said Fredde. “Once exploitation is confirmed, the priority changes.”
