CISA adds Cisco BroadWorks CVE-2026-20320 to KEV

CISA added CVE-2026-20320, an improper XML external entity restriction vulnerability in Cisco BroadWorks, to its Known Exploited Vulnerabilities catalog. The agency said the flaw is being actively exploited and set Nov. 24, 2026 as the remediation deadline for U.S. civilian federal agencies.

What did CISA say about CVE-2026-20320?

CISA added it to the KEV catalog on Nov. 10, 2026, and said it is under active exploitation. The Nov. 24 deadline stems from Binding Operational Directive BOD 26-04, according to BleepingComputer. That deadline applies to the U.S. civilian federal government, not the general public.

What technical issue does BroadWorks have?

The technical analysis reviewed identifies the flaw as CWE-611 and gives it a CVSS score of 7.5, rated high, based on Cisco’s official advisory. Threadlinqs also links it to bug CSCwv48590 and reproduces the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while tying it to advisory cisco-sa-bworks-xxe-uwUd7CEt. In practice, this is an unauthenticated XXE in BroadWorks’ OCI XML parser.

Which products are affected?

CyberSecureFox and Helix agree that the affected components are BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform, as long as they run vulnerable versions of BroadWorks. CyberSecureFox notes that the scope applies regardless of device configuration, and Helix adds that Cisco’s advisory was still at version 1.0 and did not include workarounds.

What was Cisco’s position in its advisory?

According to CyberSecureFox’s analysis, Cisco’s advisory still said PSIRT was unaware of public reports or malicious use of the vulnerability. That position conflicts with CISA’s active exploitation classification. The same review says Cisco and technical monitoring teams placed the fix in RI.2026.07.

What additional data appears in the technical records?

Rescana reported that NVD had the record marked as analyzed and was republishing Cisco’s 7.5 metric as a secondary score, without an independent primary NVD score. That fits a scenario in which the record had already been processed, but the central reference was still the rating in Cisco’s advisory.