CISA has added a high-severity Cisco BroadWorks bug, CVE-2026-20320, to its Known Exploited Vulnerabilities catalog, BleepingComputer reports. Cisco patched it in August. Federal civilian agencies have until November 24 to fix it, and CISA is telling private-sector teams to prioritize it too.
BroadWorks is the cloud communications platform carriers and MSPs use for hosted voice and collaboration. The flaw is in the Open Client Interface XML parser and can let an unauthenticated attacker read sensitive configuration from a vulnerable system. I’m not going through the attack method.
What to do
If you run BroadWorks, apply the August fixed release now. Don’t wait for the federal deadline if you’re not a government shop. Look up your train in Cisco’s advisory and patch.
God Bless, and Use the Source!
