CISA adds Cisco BroadWorks XML flaw to exploited vulnerabilities list

CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. The flaw affects Cisco BroadWorks and is an improper restriction of XML external entity (XXE) references that could let an unauthenticated remote attacker read sensitive configuration information on an affected system.

The vulnerability is rated CVSS 7.5 (HIGH). It involves processing XML external entity references and can be exploited remotely without authentication, according to the available description. The stated impact is disclosure of sensitive configuration information. Patch status is unknown, and no patch or advisory URL was provided in the entry data; consult Cisco’s advisory for current vendor guidance.

KEV inclusion indicates that exploitation has been confirmed. The entry does not establish whether the vulnerability is being used in ransomware campaigns; that status is listed as unknown. CISA set 24 November 2026 as the remediation deadline for affected federal civilian executive branch (FCEB) agencies.

CISA requires agencies to apply mitigations in accordance with Cisco’s instructions, while ensuring compliance with BOD 26-04 guidance and CISA’s Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance; discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset’s internet exposure and adhere to BOD 26-04 patching guidelines.

FCEB agencies are directly subject to the required action, and all organisations should review their exposure and consult Cisco’s advisory for mitigation details.

See the linked NVD entry and CISA KEV catalogue for full details: https://nvd.nist[.]gov/vuln/detail/CVE-2026-20320 and https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog.