Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

CISA flags Cisco and Openwave flaws as actively exploited

Part of the CVE-2026-20320 story · since 20 Aug

Developinglatest 12 hours ago6 articles5 outlets
20 Aug · SecurityOnline first1 Oct15 Oct29 OctNowThis article5th of 6
  • Thu 20 Aug, 05:21 UTC. SecurityOnline, first report. CVE-2026-20030: Cisco Crosswork SQL Command Injection Scores CVSS 10.0. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 16:31 UTC. Infosecurity, its first report on the story. Jailbroken AI agent attacked European telecom for two weeks. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA adds Cisco BroadWorks XML flaw to exploited vulnerabilities list. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 07:00 UTC. The Hacker News, its first report on the story. CISA flags Cisco and Openwave flaws as actively exploited. Cites a CVE in CISA KEV. This article, 5th of 6.
  • Wed 11 Nov, 10:02 UTC. SecurityWeek, its first report on the story. Hackers Exploit Openwave and Cisco BroadWorks Flaws. Cites a CVE in CISA KEV.

CISA added two exploited vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop to its KEV catalog on 10 November 2026, citing evidence of active exploitation. The higher‑severity flaw is CVE-2026-20320, an XML External Entity (XXE) restriction vulnerability in the Open Client Interface (OCI) XML Parser within Cisco BroadWorks. It could allow an unauthenticated, remote attacker to read sensitive configuration data on an affected system with the privileges of a BroadWorks user.

Cisco states this was fixed in August 2026. The second CVE, CVE-2026-111793, is an incorrect resource transfer between spheres vulnerability in Openwave Messaging Webtop Media Transcoder. It could let an authenticated user process and convert unintended document types if bypassing the Webmail experience; Cisco’s advisory notes this patch was applied in October 2026. CVSS scores are 7.5 for CVE-2026-20320 and 4.3 for CVE-2026-111793.

There are no published details tying the exploits to a named actor. The KEV listing corroborates active exploitation, while Cisco’s advisories for these flaws do not state that they are being used maliciously in the wild.

The article also references prior Cisco disclosures of actively exploited vulnerabilities in Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) and ASA/FTD software (CVE-2026-76418, CVSS 8.6) disclosed in October 2026, with a recommendation for Federal Civilian Executive Branch agencies to apply patches by 24 November 2026.

How the story developed

All 6 articles
Developinglatest 12 hours ago6 articles5 outlets

6 articles from 5 outlets since 20 Aug. Still developing; the latest report was 12 hours ago. This was the 5th report, 83 days after the first.

Now20 Aug219 Nov1011First reportSecurityOnline · 20 Aug, 05:21This article5th of 6 · day 83
  • Thu 20 Aug, 05:21 UTC. SecurityOnline, first report. CVE-2026-20030: Cisco Crosswork SQL Command Injection Scores CVSS 10.0. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 16:31 UTC. Infosecurity, its first report on the story. Jailbroken AI agent attacked European telecom for two weeks. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA adds Cisco BroadWorks XML flaw to exploited vulnerabilities list. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 07:00 UTC. The Hacker News, its first report on the story. CISA flags Cisco and Openwave flaws as actively exploited. Cites a CVE in CISA KEV. This article, 5th of 6.
  • Wed 11 Nov, 10:02 UTC. SecurityWeek, its first report on the story. Hackers Exploit Openwave and Cisco BroadWorks Flaws. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Thu 20 AugDay 01
    1. CVE-2026-20030: Cisco Crosswork SQL Command Injection Scores CVSS 10.005:21 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 12 weeks

    Mon 9 NovDay 811
    1. Jailbroken AI agent attacked European telecom for two weeks16:31 · Infosecurity · Picked up again · Known exploited CVE
  3. Tue 10 NovDay 821
    1. CISA adds Cisco BroadWorks XML flaw to exploited vulnerabilities list20:31 · CISA · official · CISA alert · Known exploited CVE
  4. Wed 11 NovDay 833
    1. CISA adds six exploited flaws to its KEV catalogue01:30 · SecurityOnline · Known exploited CVE
    2. CISA flags Cisco and Openwave flaws as actively exploited07:00 · The Hacker News · Known exploited CVE · This article, 5th of 6
    3. Hackers Exploit Openwave and Cisco BroadWorks Flaws10:02 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in