Cisco has issued security updates for a high-severity vulnerability in Cisco BroadWorks that could allow unauthenticated remote attackers to access sensitive configuration files on affected systems.
This vulnerability is tracked as CVE-2026-20320 and is characterized as an out-of-band blind XML External Entity (XXE) injection vulnerability in the Open Client Interface (OCI) XML Parser.
Cisco assigned it a CVSS score of 7.5 out of 10, indicating its potential for network exploitation, low attack complexity, and the lack of authentication or user interaction requirements.
Cisco BroadWorks Vulnerability
According to Cisco’s advisory, the vulnerability arises from improper parsing of XML entries within the BroadWorks OCI environment. By default, external entity resolution is enabled, which allows a remote attacker to send a specially crafted XML message to the Open Client Interface – Provisioning (OCI-P) service.
If successfully exploited, this vulnerability could allow an attacker to read sensitive files from the underlying filesystem with the permissions assigned to the Cisco BroadWorks user.
Although Cisco describes the issue as a blind, out-of-band XXE vulnerability, exploitation might still reveal configuration data, credentials, service details, or other files accessible to the application account.
The flaw is classified under CWE-611, relating to improper restriction of XML external entity reference processing. XXE vulnerabilities pose a significant risk in enterprise environments because XML parsers can be coerced to retrieve local files or interact with internal resources when external entities are not securely disabled.
Cisco confirmed that multiple BroadWorks components are affected when running vulnerable releases, regardless of the device configuration.
The impacted products include the BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform.
Organizations using these platforms should prioritize inventorying exposed BroadWorks deployments, especially those systems where the OCI-P service might be accessible from untrusted networks.
Administrators should also review network segmentation, restrict access to management and provisioning interfaces, and monitor logs for abnormal XML requests or unexpected outbound traffic originating from the BroadWorks infrastructure.
Cisco emphasized that there are no workarounds for this vulnerability; customers must upgrade to a fixed software release to fully resolve the issue.
Cisco has addressed CVE-2026-20320 in BroadWorks release RI.2026.07. Systems running releases earlier than RI.2026.07 are affected and should be upgraded to the fixed release where supported.
The company noted that the RI.2026.07 remediation applies to the affected BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform releases.
At the time of publication, Cisco’s Product Security Incident Response Team indicated that it was not aware of any public announcements, proof-of-concept exploits, or malicious exploitation of the vulnerability.
However, the risk of unauthenticated remote attacks and the absence of compensating workarounds make rapid patching essential.
The vulnerability was reported to Cisco by security researcher Sandesh M. Gawai. Organizations should consult Cisco’s advisory (cisco-sa-bworks-xxe-uwUd7CEt) for supported upgrade paths and ensure compatibility before deploying the fixed software.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
