# Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV > CISA added Cisco BroadWorks CVE-2026-20320 (unauthenticated XXE in the OCI XML Parser, CVSS 7.5) and Openwave Webtop Media Transcoder CVE-2026-111793 (CVSS 4.3, incorrect resource transfer between spheres) to the KEV catalog on 2026-11-10 on evidence of active exploitation. Exploitation methods, actors and IOCs have not been published. - **Published:** 2026-11-11T06:31:53Z - **Last reviewed:** 2026-11-11T06:31:53Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5734 - **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5734.png - **ID:** TL-2026-5734 - **Severity:** HIGH (CVSS 7.5) - **Category:** VULNERABILITY - **Status:** ACTIVE - **Detections:** 9 (1 shown free below) ยท **IOCs:** 10 - **CVEs:** CVE-2026-20320, CVE-2026-111793 ## Description CVE-2026-20320 is an XML External Entity (CWE-611) flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks. External entity resolution is allowed by default, so an unauthenticated remote attacker can send a crafted XML message to the OCI-P service and read files, including sensitive configuration information, with the privileges of the BroadWorks user. Cisco rates it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), Cisco Bug ID CSCwv48590, advisory cisco-sa-bworks-xxe-uwUd7CEt published 2026-08-19. Affected: BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform on releases earlier than RI.2026.07, regardless of device configuration. Cisco lists no workarounds. At publication Cisco PSIRT was not aware of public announcements or malicious use; CISA later listed the flaw as exploited. CVE-2026-111793 affects Openwave Messaging Webtop Media Transcoder (Webtop is a service-provider webmail platform; the transcoder converts attachments for browser preview). The transcoder does not enforce administrator-defined file type restrictions, so an authenticated user who bypasses the Webmail interface and talks to the converter directly can process and convert unintended document types. JPCERT/CC (JVNVU93403064) classifies it as CWE-669 and notes a specially crafted file may allow sensitive information to be obtained. Rated CVSS 4.3 (Medium); no vector string published. Openwave advisory CAN-2026-2032674 lists versions prior to 1.1.22.0 as affected and 1.1.22.0 or later (or a supported Media Server 2.0 release) as the remediation. Source discrepancies: The Openwave advisory states the fixed build 1.1.22.0 shipped on 2021-12-06 while the disclosure date is 2026-10-07 and the CVE was published 2026-10-16; the hunt skeleton cites an October 2026 fix. The patch for Openwave has therefore likely been available far longer than for the Cisco flaw, so exposed unpatched deployments are legacy installs. The CVE ID CVE-2026-111793 is confirmed in the CISA alert of 2026-11-10 (which lists six KEV additions in total, including Barracuda, Microsoft Outlook and Chromium CVEs unrelated to this threat). The Hacker News reports an FCEB remediation deadline of 2026-11-24; the CISA alert page itself shows no due date and references BOD 26-04. How the flaws are exploited in the wild, by whom, and from which infrastructure is not public; no IOCs, PoC or attribution were found. The two flaws are not known to be chained or related; they are tracked together because CISA added them in the same KEV batch. ## MITRE ATT&CK - T1190 Exploit Public-Facing Application - T1078 Valid Accounts - T1005 Data from Local System - T1552 Unsecured Credentials ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **Cisco BroadWorks OCI-P XXE Payload (CVE-2026-20320) - Exploitation** (`TL-2026-5734-SPL-001`) Detects HTTP POST requests to the Cisco BroadWorks OCI-P provisioning web service whose XML body declares a DOCTYPE or external ENTITY with a SYSTEM/PUBLIC/file URI, the expected exploitation pattern for the unauthenticated XXE in the OCI XML parser (CVE-2026-20320, CWE-611, CISA KEV 2026-11-10). In-the-wild payloads are unpublished, so this keys on the vulnerability class rather than a specific string. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1190 - **Data sources:** stream:http (index=network), waf_proxy_logs, cisco_broadworks_oci_p - **Severity:** high - **Confidence:** high ### Splunk SPL ```spl index=network sourcetype="stream:http" http_method=POST (uri_path="*/webservice/services/ProvisioningService*" OR uri_path="*/OCI*" OR uri_path="*/ocip*") (form_data="*!DOCTYPE*" OR form_data="*!ENTITY*") (form_data="*SYSTEM*" OR form_data="*PUBLIC*" OR form_data="*file:/*" OR form_data="*php:/*" OR form_data="*expect:/*") | stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_path values(http_user_agent) as user_agent by src_ip dest_ip | convert ctime(first_seen) ctime(last_seen) | sort - count ``` ### Microsoft KQL ```kql CommonSecurityLog | where TimeGenerated > ago(24h) | where RequestMethod =~ "POST" | where RequestURL has_any ("/webservice/services/ProvisioningService", "/OCI", "/ocip") | where AdditionalExtensions has_any ("