CVE-2026-20320
Known exploited · CISA KEV
CVSS 7.5 HIGH: a vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated… EPSS 0.8% (58th percentile).
CISA federal remediation date Nov 24
Vulnerabilities & Exploits · Zero-Day Exploit
CISA added two actively exploited flaws in Cisco BroadWorks and Openwave Messaging Webtop to its Known Exploited Vulnerabilities catalog on Nov. 10, extending a November update that already included Microsoft’s actively exploited Outlook flaw. SecurityWeek reports that Malbear Labs linked BroadWorks exploitation to a campaign targeting a European telecom provider and at least 13 organizations using its services.
In BroadWorks, a remote attacker can send crafted XML without logging in and read sensitive configuration. In Webtop, an authenticated user can bypass the webmail flow to convert unintended document types. Outlook’s separate flaw requires someone to open a crafted message file; it can make Outlook contact an attacker’s network resource and reveal the user’s NTLMv2 authentication hash. Microsoft says the Preview Pane alone cannot trigger it, and a fix cannot retract a hash already exposed.
For telecom operators, the BroadWorks and Webtop flaws create distinct service-platform risks beyond Outlook. If a provider’s systems hold subscriber, billing, or device records, customers may inherit exposure through that provider; the reported campaign is tied to one European provider and its users.
8 sources · Nov 11
Known exploited · CISA KEV
CVSS 7.5 HIGH: a vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated… EPSS 0.8% (58th percentile).
CISA federal remediation date Nov 24
Known exploited · CISA KEV
CVSS 4.3 MEDIUM: openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. EPSS 0.6% (51st percentile), up from 0.3%.
CISA federal remediation date Nov 24
Published Nov 10 by Microsoft
Known exploited · CISA KEV
CVSS 6.5 MEDIUM: product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to… Microsoft patch: Release Notes.
CISA federal remediation date Nov 24
Microsoft Security Blog
Lessons from 59 Linux Kernel Bug Reports | Microsoft Security Blog
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes.
originalCSIRT Italia / ACN
Aggiornamenti Mensili Microsoft
Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 1095 nuove vulnerabilità, di cui 1 di tipo 0-day.
originalSecurityWeek
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.
originalPart of the PlainSec briefing for 2026-11-11
Every edition of this story: BroadWorks and Webtop flaws expose messaging systems