CVE-2026-20320highCWE-611

CVE-2026-20320: falha de alta gravidade em Cisco BroadWorks

Publicada em

Seguir esta CVE+ Monitorar Cisco BroadWorks

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Ela tem alerta oficial do governo brasileiro.

ssvc Trackcvss 7.5epss 0.5%
Alerta oficial no Brasil

O governo federal publicou alerta, recomendação ou boletim que cita esta vulnerabilidade.

  • CTIR Gov · ALERTA 75/2026 · 26 ago 2026Vulnerabilidade crítica que afeta os produtos da Cisco e da Citrixler no gov.br ↗
Fonte: CTIR Gov (GSI) e CISC Gov.br, sob licença CC BY-ND 3.0.
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Cisco · Cisco BroadWorks
CVEs relacionadas — Cisco BroadWorks

No mesmo produto, das mais perigosas para as menos.

CVE-2023-20238CRITICALCVE-2023-20238EPSS 15.1%CVE-2022-20951HIGHCVE-2022-20951EPSS 2.3%CVE-2021-34785MEDIUMCisco BroadWorks CommPilot Application Software VulnerabilitiesEPSS 1.3%CVE-2022-20958HIGHCVE-2022-20958EPSS 1.1%CVE-2021-1530MEDIUMCisco BroadWorks Messaging Server XML External Entity Injection VulnerabilityEPSS 1.1%CVE-2021-34786MEDIUMCisco BroadWorks CommPilot Application Software VulnerabilitiesEPSS 1.0%