Threat video1:00
CVE-2026-20320 Cisco BroadWorks XXE: Detection & IOCs
CISA's KEV catalog lists Cisco BroadWorks CVE-2026-20320 as exploited, and this page gives 10 IOCs and 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for CVE-2026-20320 Cisco BroadWorks XXE: Detection & IOCs →
Chapters
- 0:00The hookCISA says two flaws are exploited.
- 0:05The storyCisco's fix shipped in August.
- 0:11Attack pathCISA says Cisco's XXE flaw reads files.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise2 indicators to hunt: 2 package names.
- 0:35MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to collection.
- 0:41Remediation5 steps now: Upgrade Cisco BroadWorks Application Server, Profile Server, Xtended Services Platform.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CISA says two flaws are exploited.
0:05Cisco's fix shipped in August.
0:07Openwave's fix came in 2021.
0:11CISA says Cisco's XXE flaw reads files.
0:15Openwave's transcoder converts unintended document types.
0:19Patches exist for both flaws.
0:25No threat actor is attributed. Confidence: low.
0:302 indicators to hunt: 2 package names.
0:364 ATT&CK techniques, from initial access to collection.
0:415 steps now: Upgrade Cisco BroadWorks Application Server, Profile Server, Xtended Services Platform.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.