Summary
On November 10, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Both have patches available.
| CVE | Product | CVSS | Fixed |
|---|---|---|---|
| CVE-2026-20320 | Cisco BroadWorks | 7.5 | August 2026 |
| CVE-2026-111793 | Openwave Messaging Webtop Media Transcoder | 4.3 | October 2026 |
CVE-2026-20320: Cisco BroadWorks
An XML External Entity (XXE) flaw in the Open Client Interface (OCI) XML parser. An unauthenticated remote attacker can read sensitive configuration information with the privileges of the BroadWorks user. Because BroadWorks is carrier-grade voice infrastructure, leaked configuration data can support follow-on attacks.
CVE-2026-111793: Openwave Webtop Media Transcoder
An incorrect resource transfer between spheres flaw. An authenticated user can bypass the Webmail experience and process and convert unintended document types.
What Is Not Known
No public details describe how either flaw is being exploited. There is no attribution to a specific actor, and Cisco's advisory does not mention malicious use.
Related Cisco Activity
In late October 2026, Cisco disclosed two other actively exploited flaws: CVE-2026-20127 (Catalyst SD-WAN, CVSS 10.0) and CVE-2026-76418 (Secure Firewall ASA and FTD, CVSS 8.6).
Deadline and Actions
Federal Civilian Executive Branch agencies must patch by November 24, 2026. Everyone else should treat that as a useful benchmark.
- Inventory BroadWorks and Openwave Messaging deployments.
- Apply the August (BroadWorks) and October (Openwave) fixes.
- Restrict OCI interfaces to trusted management networks.
- Review logs for unexpected XML requests to OCI, and rotate any credentials stored in BroadWorks configuration if exposure is suspected.