Skip to navigation

Threat reportVulnerabilityTL-2026-5734

Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV

highACTIVE

CISA added Cisco BroadWorks CVE-2026-20320 (unauthenticated XXE in the OCI XML Parser, CVSS 7.5) and Openwave Webtop Media Transcoder CVE-2026-111793 (CVSS 4.3, incorrect resource transfer between spheres) to the KEV catalog on 2026-11-10 on evidence of active exploitation. Exploitation methods, actors and IOCs have not been published. First disclosed .

Key facts

IdentifiersTL-2026-5734, CVE-2026-20320, CVE-2026-111793
Also known ascisco-sa-bworks-xxe-uwUd7CEt, CAN-2026-2032674, JVNVU93403064, CSCwv48590
SeverityHIGH
CVSS7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
First disclosed
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-111793 (added )
EPSSCVE-2026-20320: 0.4% (42.7th percentile); CVE-2026-111793: 0.2% (19.9th percentile)
Affected productsCisco BroadWorks (Application Delivery Platform, Application Server, Profile Server, Xtended Services Platform); Openwave Messaging Limited Webtop Media Transcoder
Weaknesses (CWE)CWE-611, CWE-669
MITRE ATT&CK techniquesT1005 Data from Local System, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1552 Unsecured Credentials
MotivationUNKNOWN
Target sectorstelecoms, service providers, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5734 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cisco BroadWorks OCI-P XXE Payload (CVE-2026-20320) - Exploitation

Detects HTTP POST requests to the Cisco BroadWorks OCI-P provisioning web service whose XML body declares a DOCTYPE or external ENTITY with a SYSTEM/PUBLIC/file URI, the expected exploitation pattern for the unauthenticated XXE in the OCI XML parser (CVE-2026-20320, CWE-611, CISA KEV 2026-11-10). In-the-wild payloads are unpublished, so this keys on the vulnerability class rather than a specific string.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190
  • Data sources: stream:http (index=network), waf_proxy_logs, cisco_broadworks_oci_p
  • Severity: high
  • Confidence: high

Splunk SPL

index=network sourcetype="stream:http" http_method=POST (uri_path="*/webservice/services/ProvisioningService*" OR uri_path="*/OCI*" OR uri_path="*/ocip*") (form_data="*!DOCTYPE*" OR form_data="*!ENTITY*") (form_data="*SYSTEM*" OR form_data="*PUBLIC*" OR form_data="*file:/*" OR form_data="*php:/*" OR form_data="*expect:/*")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_path values(http_user_agent) as user_agent by src_ip dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/webservice/services/ProvisioningService", "/OCI", "/ocip")
| where AdditionalExtensions has_any ("<!DOCTYPE", "<!ENTITY", "%3C%21DOCTYPE", "%3C%21ENTITY") or RequestContext has_any ("<!DOCTYPE", "<!ENTITY")
| where AdditionalExtensions has_any ("SYSTEM", "PUBLIC", "file:/", "php://", "expect://") or RequestContext has_any ("SYSTEM", "PUBLIC", "file:/")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, DestinationIP, DeviceVendor, DeviceProduct
| order by Hits desc

Sigma

title: Cisco BroadWorks OCI-P XXE Request (CVE-2026-20320)
id: 3b0f6c1e-5a41-4d0e-9a52-1c7a8e2b0001
status: experimental
description: Detects POST requests to the Cisco BroadWorks OCI-P provisioning web service carrying an XML DOCTYPE/ENTITY declaration, the expected exploitation pattern for the unauthenticated XXE CVE-2026-20320. Requires a WAF or reverse proxy that logs request bodies.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt
    - https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.20320
logsource:
    category: webserver
detection:
    selection_target:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/webservice/services/ProvisioningService'
            - '/ocip'
    selection_xxe:
        cs-body|contains:
            - '<!ENTITY'
            - '<!DOCTYPE'
    selection_resolver:
        cs-body|contains:
            - 'SYSTEM'
            - 'PUBLIC'
            - 'file:/'
            - 'php://'
    condition: selection_target and selection_xxe and selection_resolver
falsepositives:
    - Vulnerability scanners run by the owner against OCI-P
    - Legitimate clients that send a benign DOCTYPE without an external entity
level: high

Known false positives:

  • Authorised vulnerability scanners or penetration tests against BroadWorks OCI-P
  • Provisioning clients that emit a benign DOCTYPE with no external entity (the SYSTEM/PUBLIC/file filter normally excludes them)

Tuning notes: Requires TLS-decrypted HTTP with request body capture (Splunk Stream form_data, or WAF body logging). Confirm the real OCI-P URI on your deployment and adjust uri_path; exclude scanner source IPs via an allowlist lookup. If bodies are unavailable, pair with the KQL-001 parser-error rule.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • BroadWorks XML Parser External-Entity Errors in Host Logs (CVE-2026-20320) · unlock with TL Creds
  • BroadWorks Service Account Spawning File-Read and Collection Utilities · unlock with TL Creds
  • Direct Requests to Openwave Webtop Media Transcoder Bypassing Webmail (CVE-2026-111793) · unlock with TL Creds
  • Cisco BroadWorks OCI-P Port Reachable From Public Address (CVE-2026-20320 Exposure) · unlock with TL Creds
  • Credential Hunting in BroadWorks Configuration Files via grep/find · unlock with TL Creds
  • Webtop Media Transcoder Conversion of Administrator-Restricted File Types (CVE-2026-111793) · unlock with TL Creds
  • BroadWorks Java Process Reading Sensitive Files (CVE-2026-20320 Impact) · unlock with TL Creds
  • BroadWorks Server Outbound Connection to Public Address (Out-of-Band XXE / Exfiltration) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5734.

10 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

CVE-2026-20320 is an XML External Entity (CWE-611) flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks. External entity resolution is allowed by default, so an unauthenticated remote attacker can send a crafted XML message to the OCI-P service and read files, including sensitive configuration information, with the privileges of the BroadWorks user. Cisco rates it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), Cisco Bug ID CSCwv48590, advisory cisco-sa-bworks-xxe-uwUd7CEt published 2026-08-19. Affected: BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform on releases earlier than RI.2026.07, regardless of device configuration. Cisco lists no workarounds. At publication Cisco PSIRT was not aware of public announcements or malicious use; CISA later listed the flaw as exploited.

CVE-2026-111793 affects Openwave Messaging Webtop Media Transcoder (Webtop is a service-provider webmail platform; the transcoder converts attachments for browser preview). The transcoder does not enforce administrator-defined file type restrictions, so an authenticated user who bypasses the Webmail interface and talks to the converter directly can process and convert unintended document types. JPCERT/CC (JVNVU93403064) classifies it as CWE-669 and notes a specially crafted file may allow sensitive information to be obtained. Rated CVSS 4.3 (Medium); no vector string published. Openwave advisory CAN-2026-2032674 lists versions prior to 1.1.22.0 as affected and 1.1.22.0 or later (or a supported Media Server 2.0 release) as the remediation.

Source discrepancies: The Openwave advisory states the fixed build 1.1.22.0 shipped on 2021-12-06 while the disclosure date is 2026-10-07 and the CVE was published 2026-10-16; the hunt skeleton cites an October 2026 fix. The patch for Openwave has therefore likely been available far longer than for the Cisco flaw, so exposed unpatched deployments are legacy installs. The CVE ID CVE-2026-111793 is confirmed in the CISA alert of 2026-11-10 (which lists six KEV additions in total, including Barracuda, Microsoft Outlook and Chromium CVEs unrelated to this threat). The Hacker News reports an FCEB remediation deadline of 2026-11-24; the CISA alert page itself shows no due date and references BOD 26-04. How the flaws are exploited in the wild, by whom, and from which infrastructure is not public; no IOCs, PoC or attribution were found. The two flaws are not known to be chained or related; they are tracked together because CISA added them in the same KEV batch.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

  • Cisco BroadWorks RI.2026.07 (advisory cisco-sa-bworks-xxe-uwUd7CEt, Bug ID CSCwv48590)
  • Openwave Webtop Media Transcoder 1.1.22.0 or later (advisory CAN-2026-2032674)

Immediate actions

  • Upgrade Cisco BroadWorks Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform to RI.2026.07 or later
  • Upgrade Openwave Webtop Media Transcoder to 1.1.22.0 or later, or move to a supported Media Server 2.0 release
  • Restrict network access to the BroadWorks OCI-P service to trusted management hosts only
  • Restrict direct network access to the Webtop Media Transcoder so only the Webmail front end can reach it
  • Review logs for unusual XML requests to OCI-P and direct requests to the transcoder that bypass the Webmail interface

Workarounds

  • Cisco states no workarounds are available for CVE-2026-20320
  • Openwave lists no workarounds for CVE-2026-111793; only upgrade to the latest supported Media Server 2.0 release

Longer-term hardening

  • Track CISA KEV additions and enforce remediation deadlines (FCEB deadline reported as 2026-11-24 for these entries)
  • Disable external entity and DTD processing in XML parsers by default
  • Inventory legacy telecom and messaging components for unpatched builds

Affected and fixed versions

  • Cisco — BroadWorks (Application Delivery Platform, Application Server, Profile Server, Xtended Services Platform)
    Vulnerable versions: Releases earlier than RI.2026.07
    Fixed in: RI.2026.07
  • Openwave Messaging Limited — Webtop Media Transcoder
    Vulnerable versions: Prior to 1.1.22.0
    Fixed in: 1.1.22.0 and later; Supported Media Server 2.0 release

Timeline

  • Openwave Webtop Media Transcoder 1.1.22.0 released; per the Openwave advisory this is the fixed version for the file type restriction flaw later tracked as CVE-2026-111793
  • Cisco publishes advisory cisco-sa-bworks-xxe-uwUd7CEt for CVE-2026-20320 with fix in RI.2026.07; Cisco PSIRT not aware of malicious use
  • Openwave advisory CAN-2026-2032674 lists a disclosure date for the Webtop MediaTranscoder flaw
  • CVE-2026-111793 record published (CVSS 4.3, Medium)
  • CISA's CVE record assessment still listed exploitation of CVE-2026-111793 as none
  • Reporting cites JPCERT/CC (JVNVU93403064) warning that CVE-2026-111793 is being exploited; the developer states attacks have been observed
  • CISA adds CVE-2026-20320 and CVE-2026-111793 to the KEV catalog, among six additions, citing evidence of active exploitation
  • The Hacker News reports both flaws actively exploited despite available patches; no actor, method or IOCs disclosed
  • Remediation deadline for FCEB agencies as reported by The Hacker News

Sources cited

Other reports on CVE-2026-20320

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats