Overview
On November 10, 2026, CISA added two flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Both already have patches. Federal Civilian Executive Branch agencies must remediate by November 24, 2026.
The Vulnerabilities
| CVE | Product | CVSS | Issue | Fixed |
|---|---|---|---|---|
| CVE-2026-20320 | Cisco BroadWorks | 7.5 | XXE in the Open Client Interface (OCI) XML parser; unauthenticated remote read of sensitive configuration | August 2026 |
| CVE-2026-111793 | Openwave Messaging Webtop Media Transcoder | 4.3 | Incorrect resource transfer between spheres; an authenticated user can bypass the Webmail interface and convert unintended document types | October 2026 |
For the Openwave flaw, the developer states attacks have been observed, per a Japan Vulnerability Notes advisory. An authenticated attacker can upload a crafted file to obtain sensitive information.
Operation Snowball
CVE-2026-20320 was used in "Operation Snowball," an agentic campaign attributed to an unknown Chinese-speaking threat actor. According to Malbear Labs, the actor used an autonomous framework built on a jailbroken DeepSeek Flash model to target a European telecom provider and 13 companies hosted on its infrastructure. Over two weeks the campaign:
- Enumerated hundreds of assets
- Extracted dozens of credential sets
- Exfiltrated thousands of rows of subscriber billing and device records
- Recovered the system identity private key and SSL credentials
The primary target was BroadWorks XSP Release 23.0.1.1075 on port 2208. Tooling included Sliver, Chisel, and the Behinder web shell.
Related Cisco Activity
Late last month Cisco disclosed other actively exploited flaws in Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) and Secure Firewall ASA/FTD (CVE-2026-76418, CVSS 8.6).
Recommended Actions
- Patch BroadWorks to a release containing the August 2026 fix and Openwave Messaging to the October 2026 fix.
- Restrict access to the BroadWorks OCI interface (port 2208) so it is not reachable from untrusted networks.
- Assume compromise if an exposed, unpatched BroadWorks XSP was reachable: rotate credentials, the system identity key, and SSL certificates.
- Hunt for Sliver, Chisel, and Behinder web shell artifacts on telecom and messaging infrastructure.