Hackers Exploit Openwave and Cisco BroadWorks Flaws

Threat actors are exploiting two vulnerabilities in Openwave’s Webtop Media Transcoder and Cisco BroadWorks to access sensitive information, according to SecurityWeek. The Openwave flaw, CVE-2026-111793, arises because administrator-defined file-type restrictions are not enforced, potentially allowing an authenticated user to process and convert unintended document types if bypassing the webmail experience.

Openwave notes that Webtop Media Transcoder version 1.1.22.0, released in December 2021, contains patches for this defect, which was disclosed on 7 October and had a CVE published on 16 October. Japan’s JVN flagged the weakness as exploited on 9 November, warning that an authenticated attacker could upload a specially crafted file to obtain sensitive information.

The Cisco BroadWorks vulnerability, CVE-2026-20320, was disclosed on 19 August as an out-of-band XML external entity (XXE) injection that could be exploited remotely without authentication to read sensitive configuration data. Patches appeared in RI.2026.07 across BroadWorks components, including Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform.

Malbear Labs warned on 8 November that a Chinese-speaking threat actor has been exploiting the flaw in a broad campaign using an autonomous AI intrusion harness to target a European telecom provider and its customers, potentially enumerating assets, stealing credentials, and harvesting subscriber billing and device records—affecting at least 13 organisations via the provider’s services. On 10 November, CISA added both defects to its Known Exploited Vulnerabilities catalogue, urging federal agencies to patch by 24 November.