CISA adds Cisco BroadWorks and Openwave flaws to exploited vulnerabilities catalog
CISA has added two flaws in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence that attackers are exploiting them. The Hacker News reported the additions and said the catalog entry does not identify an attack method or threat actor.
The Cisco BroadWorks issue is CVE-2026-20320, a flaw in the Open Client Interface XML Parser. According to The Hacker News, an unauthenticated remote attacker could use it to read sensitive configuration information with the privileges of the Cisco BroadWorks user. Cisco fixed the vulnerability in August 2026.
The Openwave issue is CVE-2026-111793. The Hacker News said an authenticated user could process and convert unintended document types by bypassing the Webmail experience. Openwave fixed that vulnerability in October 2026.
The available report does not describe how either flaw is being used in attacks. It also does not attribute the activity to a named threat actor or group, and Cisco's advisory reportedly does not mention malicious use of the flaw.
CISA recommends that Federal Civilian Executive Branch agencies apply the patches by November 24, 2026. Operators of affected BroadWorks and Openwave systems should verify that the fixes are installed before that deadline where the recommendation applies.