Skip to content
securitytabs

LiveUpdated

CISA warns of attacks on Cisco BroadWorks and Openwave flaws

US authorities say attackers are exploiting flaws in Cisco's BroadWorks business phone platform and in Openwave's webmail media tool, even though fixes exist. Organizations running either product should check that they have applied the vendors' updates.

Exploited XML flaw in Cisco BroadWorks added to CISA list
Exploited XML flaw in Cisco BroadWorks added to CISA list

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

CISA added two flaws to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on 2026-11-10, citing evidence of active exploitation. They affect Cisco BroadWorks (CVE-2026-20320) and the Openwave Messaging Webtop Media Transcoder (CVE-2026-111793). [1][2]

CVE-2026-20320 is an improper restriction of XML external entity reference, a flaw in how XML input is handled. NVD rates it 7.5 on CVSS. CVE-2026-111793 is an incorrect resource transfer between spheres flaw rated 4.3. [1][2]

Exploitation

SecurityWeek reports that the flaws let attackers leak sensitive information, including configuration data. The cited sources do not name who is exploiting them or how many organizations are affected. CISA lists known ransomware use as unknown for both. [3][1]

The Hacker News reports that the flaws are being exploited despite patches being available. [2]

Deadline

CISA set a federal remediation due date of 2026-11-24 for both flaws. CISA's same update added four other flaws, including two affecting Barracuda products and one in Microsoft Outlook. [1][4]

Timeline

  1. CISA's warning that the BroadWorks flaw is being exploited drew wider coverage. [4]

  2. CISA set a federal remediation due date of 2026-11-24 for both flaws. [1]

  3. CISA added the Cisco BroadWorks and Openwave flaws to its Known Exploited Vulnerabilities catalogue. [1]

  4. · CISA KEV

    CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog.

  5. · CISA KEV

    CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities catalog.

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Most small firms do not run BroadWorks or Openwave tools themselves, but a phone or messaging provider might. Patches exist for both flaws. [2]

What to do

  1. Ask your phone or email provider whether it uses Cisco BroadWorks or Openwave Webtop. [2][1]
  2. Ask the provider to confirm it has applied the vendors' available fixes. [2]

Mid-size company

A small IT or security team

What to know

CISA set a federal due date of 2026-11-24, and the flaws are reported to leak configuration data. [1][3]

What to do

  1. Check your inventory for Cisco BroadWorks and Openwave Webtop Media Transcoder. [1]
  2. Apply the vendors' available patches, using CISA's 2026-11-24 date as a benchmark. [1][2]

Large enterprise

A security operations team

What to know

Both flaws are confirmed exploited per CISA; no indicators of compromise are given in the cited sources. [1][3]

What to do

  1. Locate every BroadWorks and Openwave Webtop deployment, including those run by third parties, and confirm patch status. [1][2]
  2. Review whether configuration data on these systems could have been exposed, since the flaws are reported to leak it. [3]

Sources

  1. [1]CISA Advisories · Nov 10, 12:00 UTC
    CISA Adds Six Known Exploited Vulnerabilities to Catalogcontext
  2. [2]The Hacker News · Nov 11, 06:04 UTC
    Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patchescontext
  3. [3]SecurityWeek · Nov 11, 09:01 UTC
    Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilitiescontext
  4. [4]BleepingComputer · Nov 11, 10:12 UTC
    CISA flags Cisco BroadWorks flaw as actively exploited in attackscontext