Openwave and Cisco BroadWorks: Information Disclosure Vulnerabilities (CVE-2026-111793, CVE-2026-20320)

CISA has added two vulnerabilities, CVE-2026-111793 and CVE-2026-20320, to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. CVE-2026-111793 affects Openwave Webtop Media Transcoder and allows an authenticated user to bypass file-type restrictions. CVE-2026-20320 is an out-of-band blind XML external entity (XXE) injection vulnerability in the Cisco BroadWorks OCI-P service, which can be exploited remotely without authentication to read sensitive configuration files.

Impact

Observed impacts include asset enumeration, credential theft, and harvesting of subscriber billing and device records. At least 13 organizations utilizing a targeted European telecommunications provider have been affected by the campaign.

Recommendation

• Patch Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform to version RI.2026.07 or later immediately.
• Patch Openwave Webtop Media Transcoder to version 1.1.22.0 or later.
• Prioritize patching by the CISA-mandated deadline of November 24, 2026.
• Review network access logs for the Cisco OCI-P service for anomalous XML-based requests or unusual outbound traffic indicative of XXE data exfiltration.