CVE entry · CVE-2026-20320
CVE-2026-20320: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
- Actively exploited: added to CISA’s KEV catalog on November 10, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 24, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Cisco BroadWorks, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (sec.cloudapps.cisco.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Cisco vulnerabilities
-
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
-
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
-
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
-
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
-
Cisco Secure Email Gateway SQL Injection Vulnerability
-
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability