CVE-2026-20320highCWE-611

CVE-2026-20320: high-severity vulnerability in Cisco BroadWorks

Published

Follow this CVE+ Monitor Cisco BroadWorks

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 7.5epss 0.5%
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 75/2026 · 26 Aug 2026Vulnerabilidade crítica que afeta os produtos da Cisco e da Citrixread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco BroadWorks
Related CVEs — Cisco BroadWorks

In the same product, most dangerous first.

CVE-2023-20238CRITICALCVE-2023-20238EPSS 15.1%CVE-2022-20951HIGHCVE-2022-20951EPSS 2.3%CVE-2021-34785MEDIUMCisco BroadWorks CommPilot Application Software VulnerabilitiesEPSS 1.3%CVE-2022-20958HIGHCVE-2022-20958EPSS 1.1%CVE-2021-1530MEDIUMCisco BroadWorks Messaging Server XML External Entity Injection VulnerabilityEPSS 1.1%CVE-2021-34786MEDIUMCisco BroadWorks CommPilot Application Software VulnerabilitiesEPSS 1.0%