CVE-2026-20320: listed in the CISA KEV catalog

CVE-2026-20320 · CVSS 7.5 HIGH · EPSS 1% · KEV 2026-11-10

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Is CVE-2026-20320 exploited?

• Listed in the CISA KEV catalog on 2026-11-10.
• Federal remediation due 2026-11-24.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Cisco · Cisco BroadWorks

Is there a patch?

Cisco's record doesn't name a fixed version.

What PlainSec published about CVE-2026-20320

• Cisco BroadWorks flaw exploited to read configuration (2026-11-12)
• BroadWorks and Webtop flaws expose messaging systems (2026-11-11)
• DeepSeek agent adapted as telecom defenses blocked attacks (2026-11-10)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-11-12.