Cisco External Entity Injection Vulnerability Allows Attackers to Read Sensitive Data

Cybersecuritynews •Abinaya • August 20, 2026

Cisco has released security updates for a high-severity XML External Entity injection vulnerability in Cisco BroadWorks that could allow unauthenticated remote attackers to read sensitive configuration data and files from affected systems. Tracked as CVE-2026-20320, the issue carries a CVSS score of 7.5 and affects several components of the BroadWorks platform. The vulnerability, identified in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cisco BroadWorks Vulnerability Exposes Sensitive Data to Remote Attackers Cisco has issued security updates for a high-severity XML External Entity injection vulnerability in Cisco BroadWorks, tracked as CVE-2026-20320. This flaw allows unauthenticated remote attackers to read sensitive configuration data and files from affected systems. The vulnerability, identified in the Open Client Interface XML Parser, has a CVSS score of 7.5 and could lead to various attacks, including remote code execution and authentication bypasses. Cisco has confirmed that several components of the BroadWorks platform are affected. Security updates have been released to mitigate the risks associated with this vulnerability. Organizations using Cisco BroadWorks are advised to apply these updates promptly to protect against potential exploitation. 4 sources 68

Extracted Entities

Cisco External Entity Injection Vulnerability Allows Attackers to Read Sensitive Data

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)