Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

What happened

Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches  Ravie Lakshmanan  Nov 11, 2026 Vulnerability / Enterprise Security The U.S. Cisco is an infrastructure platform and telecommunications company based in San Jose.

(Fixed in October 2026) There are currently no details on how the vulnerabilities are being exploited in real-world attacks, nor have they been attributed to a specific named threat actor or group.

Late last month, Cisco revealed that two different vulnerabilities in Catalyst SD-WAN ( CVE-2026-20127 , CVSS score: 10.0) Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software ( CVE-2026-76418 , CVSS score: 8.6) have been actively exploited in the wild. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity reference vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system with the privileges of the Cisco BroadWorks user.

(Fixed in August 2026) CVE-2026-111793 (CVSS score: 4.3) - An incorrect resource transfer between spheres vulnerability in Openwave Messaging Webtop Media Transcoder that could allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Cisco's advisory also makes no mention of the flaw being maliciously used.