Cisco has released security updates for a high-severity vulnerability in Cisco BroadWorks that could allow unauthenticated remote attackers to disclose sensitive configuration information from affected systems.
Tracked as CVE-2026-20320, the issue is an out-of-band blind XML External Entity (XXE) injection flaw in the Open Client Interface (OCI) XML parser and carries a CVSS score of 7.5 out of 10.
Cisco describes the vulnerability as network-exploitable, requiring neither authentication nor user interaction.
Cisco BroadWorks XXE Flaw
The flaw affects BroadWorks environments where the vulnerable OCI parsing behavior is present, making rapid exposure assessment important for service providers and enterprises operating the platform.
The vulnerability stems from improper parsing of XML entries in the Cisco BroadWorks OCI environment. External entity resolution is enabled by default, allowing an attacker to submit a specially crafted XML message to the Open Client Interface–Provisioning (OCI-P) service.
A successful exploit could cause the vulnerable parser to retrieve files accessible to the Cisco BroadWorks application account.
While Cisco classifies the weakness as a blind, out-of-band XXE issue, attackers may still be able to obtain sensitive filesystem content indirectly through externally controlled interaction channels.
Potentially exposed data could include configuration files, service parameters, internal host details, application credentials, and other information readable by the BroadWorks user.
Such information can enable follow-on activity, including targeted access attempts against adjacent systems, service-account abuse, or more effective reconnaissance of a telecom environment.
The vulnerability is mapped to CWE-611, “Improper Restriction of XML External Entity Reference,” a weakness category associated with XML parsers that process attacker-controlled external entities.
XXE flaws can permit local file disclosure and, depending on parser configuration and network controls, interaction with internal resources.
Affected BroadWorks Platforms
Cisco confirmed that the issue affects multiple BroadWorks components when they run vulnerable releases, independent of device configuration. The affected products are:
- Cisco BroadWorks Application Delivery Platform
- Cisco BroadWorks Application Server
- Cisco BroadWorks Profile Server
- Cisco BroadWorks Xtended Services Platform
The broad product scope makes asset discovery a priority. Administrators should identify every BroadWorks deployment, determine whether OCI-P is enabled or reachable, and verify the installed release against Cisco’s advisory.
Cisco has fixed CVE-2026-20320 in BroadWorks release RI.2026.07. Systems running releases earlier than RI.2026.07 should be upgraded to a supported fixed release.
Cisco stated that there are no workarounds for the vulnerability. Applying the vendor-provided software update is the only complete remediation path.
Until patching is complete, organizations should reduce exposure by restricting OCI-P and other provisioning interfaces to trusted administrative networks, enforcing network segmentation, and, wherever possible, preventing direct internet access to management services.
Security teams should also monitor BroadWorks infrastructure for unusual XML payloads, malformed provisioning requests, and unexpected outbound DNS or HTTP(S) traffic activity that can indicate attempted out-of-band XXE exploitation.
Reviewing application and network logs may help identify reconnaissance or exploitation attempts. At the time of publication, Cisco PSIRT said it was not aware of any public proof-of-concept code or malicious exploitation of CVE-2026-20320.
Nonetheless, the lack of authentication requirements and absence of compensating workarounds raise the urgency for operators of exposed BroadWorks systems. The vulnerability was reported to Cisco by security researcher Sandesh M. Gawai.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
