Cisco BroadWorks Vulnerability Exposes Sensitive Data to Remote Attackers

• •CVE-2026-20320 allows unauthenticated remote access to sensitive files in Cisco BroadWorks.
• •The vulnerability has a CVSS score of 7.5, indicating high severity.
• •Cisco has released security updates to address the vulnerability across affected systems.

Cisco has issued security updates for a high-severity XML External Entity injection vulnerability in Cisco BroadWorks, tracked as CVE-2026-20320. This flaw allows unauthenticated remote attackers to read sensitive configuration data and files from affected systems. The vulnerability, identified in the Open Client Interface XML Parser, has a CVSS score of 7.5 and could lead to various attacks, including remote code execution and authentication bypasses. Cisco has confirmed that several components of the BroadWorks platform are affected. Security updates have been released to mitigate the risks associated with this vulnerability. Organizations using Cisco BroadWorks are advised to apply these updates promptly to protect against potential exploitation.