Overview
- CISA on Tuesday added CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog and told federal agencies to patch by November 24.
- The BroadWorks bug is an unauthenticated XML external entity (XXE) flaw that can let a remote attacker read sensitive configuration files by sending crafted XML to the Open Client Interface parser.
- The Openwave Transcoder flaw lets an authenticated user bypass administrator file-type checks to process unexpected document types, and both vendors published patches in August and October respectively.
- Security researchers report active campaigns using the BroadWorks flaw, including a claim that a Chinese-speaking actor used an AI-driven intrusion harness to harvest credentials and subscriber billing and device records from a European telecom.
- If unpatched, the flaws threaten telecom carriers and their customers by exposing account and configuration data, and defenders should apply vendor updates and network controls now to stop lateral access and credential theft.