CISA's KEV lists Cisco BroadWorks CVE-2026-20320 83 days after the advisory, which still says no malicious use

83 days from Cisco's advisory to the KEV listing, and one sentence that has not moved

Cisco published its advisory for CVE-2026-20320, a flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks, at 16:00 GMT on Wednesday 19 August 2026. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on Tuesday 10 November 2026. That is 83 days (derived: 19 August to 10 November). As read from 06:45 UTC on Wednesday 11 November 2026, Cisco's advisory is still version 1.0, its revision history lists one entry, "Initial public release", dated 2026-AUG-19, and its Exploitation and Public Announcements section reads:

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

The interval does not show that anyone was attacking BroadWorks for 83 days, and it does not show that Cisco's sentence was false when it was written. It does not show who exploited the flaw, when, against how many systems, or what was read. Neither Cisco's page nor CISA's KEV entry prints any of that. What the records do show is two statements about exploitation that a reader has to reconcile: Cisco's page, unchanged since 19 August, and CISA's own enrichment data on the same CVE, which said Exploitation none on 19 August and says Exploitation active as of 10 November.

A third party enters the picture two days before the listing. Malbear Labs published a post dated 8 November that names this flaw as the entry point into a telecom provider's network (this site's account of that post is in an earlier briefing). Both the CVE record and the NVD record list that post among CISA's references. Neither says the KEV listing rests on it, and this site does not say so either.

Who says what about exploitation

Seven places speak to exploitation of this flaw, and they do not say the same thing. The table gives each one's own words or values, with a column for what it leaves unsaid. Cisco is the vendor of BroadWorks and wrote both the advisory and its exploitation line, so it has an interest in how its own product's record reads; the advisory itself says customers may download only software procured from Cisco directly or through an authorised reseller or partner.

Zoom

Two details are easy to miss. First, only one of CISA's three values moved. Automatable yes and Technical Impact partial were already on the record on 19 August, the day of the advisory (copy read on 9 November by brief 639); Exploitation is the value that changed, from none to active, with a timestamp of 10 November. Second, the CVE record now holds both statements in one place: Cisco's container still carries the not aware sentence while CISA's container, in the same record, says active.

The Malbear link deserves care in both directions. The CVE record's CISA-ADP container lists the post as a reference tagged third-party-advisory, and the NVD record lists it with CISA-ADP as the source and the tags Exploit and Third Party Advisory. That is a citation, not an explanation. The KEV entry itself prints no evidence field. Whether the listing rests on the post, on other evidence, or on both is not stated by CISA, by NVD or by Malbear.

What the advisory says the flaw is

Cisco describes an unauthenticated, remote attacker who could "read sensitive configuration information on an affected system". The cause, in Cisco's words, is that XML entries are improperly parsed because "external entity resolution being allowed by default". The route is a crafted XML message sent to the Open Client Interface, Provisioning (OCI-P) service. A successful exploit could let the attacker "view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user". The weakness class is CWE-611 (improper restriction of XML external entity reference). The advisory title adds "Out-of-Band Blind" to the XXE label; the page does not explain either word.

Cisco rates it High, with a CVSS 3.1 base score of 7.5. The vector is network, low complexity, no privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, no availability impact. The advisory page appends temporal metrics (E:X/RL:X/RC:X, all not defined); the CVE and NVD records carry the base vector, and NVD attributes the score to Cisco's PSIRT, not to NVD itself. Cisco says there are no workarounds. The Cisco bug id is CSCwv48590, and the CVE record says the report was external; the advisory thanks a researcher by name, which this briefing does not repeat.

What the page does not give a defender is a way to tell whether a node is reachable or was read. It prints no port, no request shape, no log line, no indicator and no detection query. It says nothing about whether OCI-P is normally exposed beyond the operator's provisioning network. Everything an operator needs to answer that sits in the operator's own configuration, not on the page.

Which releases: earlier than RI.2026.07, whatever the configuration

For each of four products Cisco prints the same rule: affected if earlier than RI.2026.07, first fixed in RI.2026.07. The four are the BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. The page says they are affected "regardless of device configuration", which on its own wording means a configuration setting does not take a node out of scope. It also says "Only products listed in the Vulnerable Products section of this advisory are known to be affected", which is a statement about what Cisco knows, not a list of everything else that was checked.

Three things in that table are not settled by the page. The footnote on the Application Delivery Platform row reads "Open Client Server (OCS) and OCIOverSoap." and the page does not say what it qualifies. The summary names OCI-P as the service that receives the crafted message; the footnote names two other components. RI.2026.07 is a release name, not a date, and neither Cisco's page nor the CVE record gives a release date for it. And NVD's bound for the Application Server is 2026.0, where Cisco's is RI.2026.07; this site has not tested how any scanner treats that string and does not say it is an error, only that it differs from the vendor's line.

The affected range also does not map onto the build string in the one account of use. Malbear's post names an XSP at "Release 23.0.1.1075". Cisco's page, the CVE record and NVD all speak in the RI.2026.07 form, and none of them says whether the build in Malbear's post is earlier than RI.2026.07. A defender holding a node on a numbered release has to ask Cisco how the two schemes relate.

A "not aware" line is a dated statement, not a control

The Cisco sentence reads as present tense, but it is a statement about what one team knew on the day the advisory went out. A reader who triages by the vendor's page alone sees no malicious use. That reading matched what the advisory stated on 19 August. Whether it matches now depends on whether Cisco revises the page, and Cisco's own policy points the other way: for an advisory marked Final, "There will be no further updates unless there is a material change in the nature of the vulnerability." Whether Cisco treats a KEV listing as such a change is not stated on any page read.

The label "Final" and the label "not aware" are comfortable words. Neither is a control. The risk based disclosure page that the advisory links says Cisco will continue to release out of cycle advisories "in exigent circumstances such as active exploitation", which describes what Cisco does when it learns of exploitation; it does not say Cisco has learned of any here. The practical consequence is for the operator: a vendor's exploitation line is an input with a date on it, and a government catalogue that says otherwise is a newer input.

CISA's own directive explains why its catalogue carries weight for some readers. BOD 26-04 sets remediation urgency from four variables: asset exposure, KEV status, exploit automation and technical impact. It says CISA publishes the answers on KEV status, exploit automation and technical impact for every CVE ID through services such as the Vulnrichment Program, which is the programme behind the CISA-ADP data in the CVE record. The directive applies to federal civilian agencies and, in its words, does not apply to contractors unless the procurement contract says so. A private operator is not bound by the KEV due date of 24 November, but the entry is a published signal about this CVE.

The clock

The diagram sets the dates side by side. Every date is as printed by its own source; every interval is derived by this site.

Zoom

The post's date is 8 November as the post itself prints it. The post says its transcripts cover "more than two weeks of autonomous operation" and that a sweep surfaced the workspace "In November 2026"; it gives no date for the use of this flaw. So the 81 and 2 day intervals are between publication dates, not between events in an intrusion.

What Malbear says about this CVE, and no more

Malbear Labs, in a post dated 8 November, says "CVE-2026-20320 was the entry point into the telecom provider's network via the BroadWorks XSP." It says the target was an XSP at "Release 23.0.1.1075, running on port 2208", and that a crafted OCI request to that port makes the XML parser read arbitrary files with no prior authentication. It says that from the XSP host the agent recovered a system identity private key, three SSL credential sets and three further private keys. These are Malbear's statements about its recovered workspace, not Cisco's or CISA's.

The post does not give a date for the use of this flaw, does not name the provider, and does not say it told Cisco or CISA. Its reference list does not include Cisco's advisory. It describes a separate exposure on the BroadWorks Provisioning Server, an unauthenticated directory listing, which is not this CVE and has no CVE number in the post. The post's indicator table lists campaign infrastructure; none of it is tied to this flaw, and this briefing does not reproduce it.

Set against Cisco's page, the post is broader in one respect. Cisco and the CVE record say sensitive configuration information and files readable by the BroadWorks user; Malbear says arbitrary files and lists private keys. Those are compatible, since keys can sit in readable configuration, but the advisory does not say what a read would typically yield and does not mention keys.

What the records state, and what they do not

Where the sources differ

These are differences between sources, left unresolved.

Exploitation. Cisco's advisory and Cisco's CVE data say Cisco is not aware of malicious use. CISA's data says Exploitation active and the KEV catalogue lists the flaw. The two are not reconciled on any page read.

Version bounds. Cisco prints earlier than RI.2026.07 for all four products. NVD's configuration block prints ri.2026.07 for the Application Delivery Platform, 2026.0 for the Application Server, and 2026.07 for the Profile Server and the Xtended Services Platform.

Release naming. Cisco's page uses RI.2026.07. Malbear names an XSP at Release 23.0.1.1075. No source maps one to the other.

The service reached. Cisco's summary names OCI-P. The footnote on the Application Delivery Platform row names Open Client Server (OCS) and OCIOverSoap and does not say what it qualifies. Malbear says OCI and a port.

Scope of the read. Cisco: sensitive configuration information and files readable by the BroadWorks user. Malbear: arbitrary files, and keys recovered.

Vector. The advisory page prints the base vector with E:X/RL:X/RC:X appended. The CVE record and NVD print the base vector only. The base score is 7.5 in all three.

Name. Cisco titles the flaw an Out-of-Band Blind XML External Entity Injection Vulnerability. The KEV entry names it an Improper Restriction of XML External Entity Reference Vulnerability.

What to do, in order

Technical details

None of the sources read prints a request, a payload, an indicator or a detection query for this flaw, and this briefing writes none. What follows is every artifact the sources do print: advisory fields, the fixed releases table, the exploitation sentence, the CVE record's exploitation and enrichment fields, the KEV entry, the NVD configuration, and the build string in Malbear's post. Each block is copied from the saved page or record; JSON blocks are re-indented and trimmed to the fields named in the caption.

Advisory fields. The header of Cisco's advisory, one field per line. A defender uses the id and bug id to match the advisory in a vulnerability scanner or a Cisco support case.

Advisory ID: cisco-sa-bworks-xxe-uwUd7CEt
First Published: 2026 August 19 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCwv48590
CVE-2026-20320
CWE-611
CVSS Score: Base 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X
Revision History: 1.0 | Initial public release. | - | Final | 2026-AUG-19

Fixed releases. The table that decides whether a node is in scope. A defender compares each node's release against it, per product.

BroadWorks Application Delivery Platform Release | First Fixed Release
Earlier than RI.2026.07 (footnote marker 1) | RI.2026.07
1. Open Client Server (OCS) and OCIOverSoap.

BroadWorks Application Server Release | First Fixed Release
Earlier than RI.2026.07 | RI.2026.07

BroadWorks Profile Server Release | First Fixed Release
Earlier than RI.2026.07 | RI.2026.07

BroadWorks Xtended Services Platform Release | First Fixed Release
Earlier than RI.2026.07 | RI.2026.07

The exploitation sentence and the revision history. Cisco's only statement on exploitation, and the page's only revision entry. A defender records the date it was read.

Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Cisco's CVE data. The same sentence sits in the exploits field of Cisco's container in the CVE record, last updated 19 August. The record's discovery field says external.

{
 "exploits": [
  {
   "lang": "en",
   "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
  }
 ],
 "source": {
  "advisory": "cisco-sa-bworks-xxe-uwUd7CEt",
  "discovery": "EXTERNAL",
  "defects": [
   "CSCwv48590"
  ]
 },
 "cna_providerMetadata_dateUpdated": "2026-08-19T16:39:04.920Z"
}

CISA's enrichment, now and then. The first block is the CISA-ADP container as read on 11 November. The second is the same container as read on 9 November, when its only metric was the SSVC entry with Exploitation none. A defender uses the pair to see which value moved.

{
 "adp_metrics": [
  {
   "other": {
    "type": "ssvc",
    "content": {
     "timestamp": "2026-11-10T00:00:00+00:00",
     "options": [
      {
       "Exploitation": "active"
      },
      {
       "Automatable": "yes"
      },
      {
       "Technical Impact": "partial"
      }
     ],
     "role": "CISA Coordinator",
     "version": "2.0.3",
     "id": "CVE-2026-20320"
    }
   }
  },
  {
   "other": {
    "type": "kev",
    "content": {
     "dateAdded": "2026-11-10",
     "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20320"
    }
   }
  }
 ],
 "adp_references": [
  {
   "url": "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign",
   "tags": [
    "third-party-advisory"
   ]
  },
  {
   "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20320",
   "tags": [
    "government-resource"
   ]
  }
 ],
 "adp_timeline": [
  {
   "time": "2026-11-10T00:00:00.000Z",
   "lang": "en",
   "value": "CVE-2026-20320 added to CISA KEV"
  }
 ]
}

{
 "adp_metrics": [
  {
   "other": {
    "type": "ssvc",
    "content": {
     "timestamp": "2026-08-19T19:13:45.421692Z",
     "id": "CVE-2026-20320",
     "options": [
      {
       "Exploitation": "none"
      },
      {
       "Automatable": "yes"
      },
      {
       "Technical Impact": "partial"
      }
     ],
     "role": "CISA Coordinator",
     "version": "2.0.3"
    }
   }
  }
 ],
 "adp_providerMetadata": {
  "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
  "shortName": "CISA-ADP",
  "dateUpdated": "2026-08-19T19:14:41.602Z"
 }
}

The KEV entry. The whole entry as printed in the catalogue feed. The requiredAction field points at BOD 26-04 and its forensic triage requirements; the forensicTriage field for this entry is No. A defender in scope of the directive acts on the dueDate.

{
 "cveID": "CVE-2026-20320",
 "vendorProject": "Cisco",
 "product": "BroadWorks",
 "vulnerabilityName": "Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability",
 "dateAdded": "2026-11-10",
 "shortDescription": "Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.",
 "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
 "dueDate": "2026-11-24",
 "knownRansomwareCampaignUse": "Unknown",
 "forensicTriage": "No",
 "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20320",
 "cwes": [
  "CWE-611"
 ]
}

The NVD configuration. NVD's version bounds for the four products and its KEV fields, as read on 11 November. The block carries no source field. A defender whose scanner consumes NVD data should compare it with the Cisco table above, since the Application Server bound differs.

{
 "id": "CVE-2026-20320",
 "vulnStatus": "Analyzed",
 "lastModified": "2026-11-11T05:19:43.487",
 "cisaExploitAdd": "2026-11-10",
 "cisaActionDue": "2026-11-24",
 "configurations": [
  {
   "nodes": [
    {
     "operator": "OR",
     "negate": false,
     "cpeMatch": [
      {
       "criteria": "cpe:2.3:a:cisco:broadworks_application_delivery_platform:*:*:*:*:*:*:*:*",
       "versionEndExcluding": "ri.2026.07"
      },
      {
       "criteria": "cpe:2.3:a:cisco:broadworks_application_server:*:*:*:*:release_independent:*:*:*",
       "versionEndExcluding": "2026.0"
      },
      {
       "criteria": "cpe:2.3:a:cisco:broadworks_profile_server:*:*:*:*:release_independent:*:*:*",
       "versionEndExcluding": "2026.07"
      },
      {
       "criteria": "cpe:2.3:a:cisco:broadworks_xtended_services_platform:*:*:*:*:release_independent:*:*:*",
       "versionEndExcluding": "2026.07"
      }
     ]
    }
   ]
  }
 ]
}

The build string in the one account of use. Malbear's line about the targeted node. It is Malbear's wording, not Cisco's, and Cisco's page prints no port. A defender uses it only to ask Cisco how the build relates to RI.2026.07.

BroadWorks XSP (eXtended Services Platform), Release 23.0.1.1075, running on port 2208.

The question Cisco's page leaves open

If an operator's change control reads the vendor's advisory and the vendor's advisory says no malicious use, what tells that operator on day 84 that a government catalogue has said otherwise since day 83? Cisco's page has not changed, CISA's data has, and the only thing joining them is a reader who checks both.

Key facts