Cisco BroadWorks Flaw Exploited in the Wild: Patch and Check Now

What to do first

BroadWorks is carrier-grade telephony software, so readers usually fall into one of two groups: those who run it and those whose phone service runs on it. The actions differ, so settle which group you are in before anything else.

Cisco says no workaround exists. The fix is the upgrade. The other steps below limit exposure while you arrange it and deal with the possibility that an unpatched server has already been read from.

1. Establish whether you operate BroadWorks yourself or consume it from a service provider. If it is a provider, go straight to the customer section further down.
2. List every BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform you run, with its release number. Any release earlier than RI.2026.07 is affected, and Cisco states this applies regardless of device configuration.
3. Plan the upgrade to RI.2026.07 or later through your normal change process. This is a telephony platform, so expect a maintenance window and confirm the upgrade path for your current release with Cisco or your supplier before you start.
4. Until the upgrade is done, check which systems can reach the OCI-P service and narrow that to the provisioning systems that genuinely need it. This is engineering judgement rather than a Cisco-approved workaround, and it will break any legitimate client you have not identified, so list those clients first.
5. Review network and application logs for OCI-P connections from addresses that are not your own provisioning systems, particularly on internet-facing servers. Unfamiliar sources mean you should treat the server as possibly read from and escalate to your incident process.
6. After patching, confirm each system reports a release of RI.2026.07 or later, and decide whether stored secrets need replacing (see the section on what patching does not undo).

Which systems are affected

Cisco's advisory, first published on 19 August 2026, lists four BroadWorks products as vulnerable when running an affected release. Cisco says only these products are known to be affected.

• BroadWorks Application Delivery Platform (Cisco notes this covers the Open Client Server and OCIOverSoap components)
• BroadWorks Application Server
• BroadWorks Profile Server
• BroadWorks Xtended Services Platform

What the flaw allows

The OCI XML parser accepts XML that can point at external resources, and Cisco says external entity resolution is allowed by default. This weakness class is known as an XML external entity (XXE) flaw, tracked as CWE-611. A crafted message sent to the OCI-P service can make the server fetch and expose files from its own filesystem, with the privileges of the BroadWorks user. Cisco describes the result as disclosure of sensitive configuration information.

Cisco scores it 7.5 (High) with a network attack vector, low complexity, no privileges and no user interaction needed. Confidentiality is the only impact scored, so the flaw reads data; it does not by itself change or take down the server. In telephony, though, configuration files can hold the very things that unlock further access, which is why stolen files matter more than a bare 7.5 suggests. That last point is our judgement, not a Cisco statement.

What is known about exploitation

CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalogue on 10 November 2026, with a due date of 24 November 2026 for US federal civilian agencies. CISA has not published who is exploiting it, how, or against whom. The deadline binds federal agencies only, but CISA encourages every organisation to prioritise catalogue entries.

Cisco's advisory carries a single revision, dated 19 August 2026, and states that Cisco PSIRT was not aware of malicious use at that time. That statement predates the CISA listing and should be read as the position in August, not today.

Beyond CISA, a security firm called Malbear Labs has reported a campaign using this flaw against a European telecommunications provider and organisations using its infrastructure, as relayed by BleepingComputer and SecurityWeek. As reported, the activity involved sending crafted requests to the provisioning service, reading files, and recovering private keys and certificate material from a server in the Xtended Services Platform role. The attribution of the actor comes only from that firm and has not been independently confirmed in the coverage we checked, so we do not repeat it as fact. No affected organisation has been publicly named, and we do not name any.

What patching does not undo

Installing RI.2026.07 closes the hole. It does not return anything an attacker has already copied. If a server was reachable by untrusted networks while unpatched, assume files readable by the BroadWorks user could have been exposed.

In practice that means working out which credentials, private keys and certificates live in readable configuration on each affected server, and replacing the ones that matter. Do this as a planned piece of work: swapping keys or certificates on a live telephony platform can interrupt the components that trust them, so agree the order and timing with Cisco or your supplier. Whether you need to rotate anything depends on what your servers store and whether the exposure is realistic, which only you can judge.

If you are a customer rather than the operator

Businesses that receive hosted voice or unified communications from a provider cannot patch BroadWorks themselves, and nothing in the advisory asks them to. The sensible move is to ask the provider in writing whether their BroadWorks estate is on RI.2026.07 or later, whether the OCI-P service was exposed beyond their provisioning systems, and whether they have found any sign of access. Note that the provider also holds your subscriber and device configuration, so a plain answer is reasonable to expect.

Separately, if your provider tells you credentials or device provisioning details may have been exposed, follow their instructions on changing handset or trunk passwords and re-provisioning. Do not invent a response before you have their statement.