Cisco BroadWorks · Exploitation confirmed

CISA confirms exploitation of Cisco BroadWorks flaw

Nov 10, 2026 · 1 min read

CVE-2026-20320 allows an unauthenticated remote attacker to read sensitive configuration information through an XML external entity (XXE). CISA added the flaw to KEV and directs organizations to apply Cisco's mitigations.

By HIFY Radar newsroom Updated 11/10/2026 04:18 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityExploitation confirmedFix unconfirmed

In this article

For the technical team
Timeline
Sources

For the technical team

CVE: CVE-2026-20320
Affected: Cisco BroadWorks
Exploitation: Exploitation confirmed
Fix: Fix unconfirmed

Timeline

11/10/2026 04:18 PM
CISA confirmed exploitation and set a November 24, 2026 federal deadline.

Sources 1 source

CVE-2026-20320: Cisco BroadWorks (Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability) CISA KEV

Share it with your team

Whoever handles security with you should get it too.

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

CISA confirms exploitation of Cisco BroadWorks flaw

Incidents like this, every morning

For the technical team

Timeline

Sources 1 source

Get the next one tomorrow morning

Share it with your team

Read also