CISA Adds Actively Exploited Cisco and Openwave Flaws to KEV

The United States Cybersecurity and Infrastructure Security Agency (CISA) has added two security vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation in the wild. The Cisco flaw, designated as CVE-2026-20320, carries a CVSS score of 7.5, whilst the Openwave issue, tracked as CVE-2026-111793, is rated at CVSS 4.3. Systems running these enterprise software components face potential unauthorised configuration disclosure and document conversion issues if patches released earlier this year remain unapplied.

Key Facts

How Do These Vulnerabilities Function?

The vulnerabilities allow attackers to extract sensitive data or manipulate file processing on affected platforms. In Cisco BroadWorks, an unauthenticated remote attacker can exploit an XML external entity flaw to read configuration files. In Openwave Messaging Webtop Media Transcoder, an authenticated user can bypass webmail controls to convert unintended document types.

Specifically, CVE-2026-20320 resides in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks, allowing an unauthenticated remote attacker to view sensitive configuration details with the execution privileges of the Cisco BroadWorks user. The second flaw, CVE-2026-111793, involves an incorrect resource transfer between spheres in Openwave Messaging Webtop Media Transcoder, triggered when an authenticated user circumvents the standard Webmail experience.

Cisco resolved CVE-2026-20320 in August 2026, whilst Openwave addressed CVE-2026-111793 in October 2026.

Who Is Behind the Active Exploitation?

No specific threat actor or cybercriminal group has been linked to the attacks, and technical details outlining active exploit methods remain undisclosed. Although CISA confirmed evidence of active exploitation, Cisco's own advisory makes no mention of malicious use, leaving the exact nature of the real-world campaigns unconfirmed publicly.

The development follows disclosures late last month regarding two other actively exploited Cisco vulnerabilities: a critical flaw in Catalyst SD-WAN (CVE-2026-20127, CVSS score: 10.0) and a high-severity bug in Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software (CVE-2026-76418, CVSS score: 8.6).

There are currently no details on how the vulnerabilities are being exploited in real-world attacks.

What Should You Do?

• Apply the official Cisco security updates released in August 2026 for affected Cisco BroadWorks deployments.
• Install the official vendor patch issued in October 2026 for Openwave Messaging Webtop Media Transcoder.
• Adhere to remediation timelines, noting that US Federal Civilian Executive Branch agencies are mandated to remediate both flaws by 24 November 2026.
• Malaysian organisations and IT administrators observing anomalous activity or suspected compromise may report incidents directly to Cyber999 via MyCERT.

Common Questions

What is the severity of CVE-2026-20320?

CVE-2026-20320 holds a CVSS score of 7.5. It allows unauthenticated remote attackers to exploit an improper restriction of XML external entity reference vulnerability in the Cisco BroadWorks OCI XML Parser, potentially exposing sensitive configuration information with the privileges of the system user.

Are there known threat actors exploiting these flaws?

No threat group has been named or attributed to the attacks. CISA confirmed that evidence of active exploitation exists, but neither CISA nor Cisco has released public details regarding the threat actors involved, intrusion techniques, or victim profiles.

When were fixes released for these vulnerabilities?

Vendors resolved both vulnerabilities prior to CISA's catalogue update. Cisco released a security fix for Cisco BroadWorks in August 2026, while the vulnerability affecting Openwave Messaging Webtop Media Transcoder was officially resolved in October 2026.

Sources and Methodology

This dispatch is based solely on reporting published by The Hacker News on 11 November 2026. No secondary documentation, external advisories, or unverified technical materials were reviewed for this report.