Covered by 3 outlets — first reported by The Hacker News, Nov 11, 06:04 UTC
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
MentionsCisco
Summary
CISA added two flaws, one in Cisco BroadWorks (CVE-2026-20320) and one in the Openwave Messaging Webtop Media Transcoder (CVE-2026-111793), to its Known Exploited Vulnerabilities catalogue on Tuesday, citing evidence of active exploitation. The Cisco flaw is an improper restriction of XML external entity references rated CVSS 7.5. SecurityWeek reports the flaws let attackers leak sensitive information, including configuration data, and The Hacker News notes patches are available for both. CISA has set a federal remediation due date of 2026-11-24.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, SecurityWeek, BleepingComputer. Read the outlets below for the full story.
Continue reading
3 outlets, in the order they reported it.
The Hacker NewsFirst report
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing…
SecurityWeek
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.
BleepingComputer
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks.
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.