A newly issued advisory from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has spotlighted two vulnerabilities in Cisco BroadWorks and Openwave Messaging that are already being exploited in the wild—despite patches being public for both. These issues have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, meaning organizations using these systems are now on notice to act fast.
The Vulnerabilities Explained
The first vulnerability, tracked as CVE-2026-20320, involves Cisco BroadWorks. It’s a flaw in the Open Client Interface (OCI) XML parser that improperly handles external XML entity references. An attacker who isn’t authenticated could use this to read sensitive configuration information on devices running BroadWorks—using privileges tied to the Cisco BroadWorks user. Cisco released a patch for this issue in August 2026.
The second recorded flaw, CVE-2026-111793, exists in Openwave Messaging’s Webtop Media Transcoder. This one permits an authenticated user to bypass the standard webmail interface and process document types they shouldn’t have access to—thanks to an incorrect resource transfer between execution ‘spheres.’ The fix for this vulnerability went out in October 2026.
Exploit Status, Patch Deadlines & Agency Advisory
Although specific details about which threat actors are exploiting these flaws—or how precisely they’re being used—remain unknown, there is confirmation that both are being actively weaponized. The Cisco advisory doesn’t link the exploitations to named groups.
CISA is urging all Federal Civilian Executive Branch (FCEB) agencies to apply the available patches by November 24, 2026. The deadline underscores the urgency, given that both vulnerabilities are now included in the KEV catalog—a sign that the agency considers them to be real, present threats.
These additions follow a trend: recently, two vulnerabilities in Cisco’s Catalyst SD-WAN and Secure Firewall products were also confirmed as being exploited in the wild (CVE-2026-20127 and CVE-2026-76418), with critical severity ratings.
Organizations using Cisco BroadWorks or Openwave should assume these systems are under active threat if they haven’t yet applied patches. Even without public exploits disclosed, inclusion in KEV means attackers are likely already targeting unpatched systems. Administrators should confirm patch status for August and October updates respectively and deploy them immediately in any high-risk or exposed environments.
This situation highlights a broader challenge in cybersecurity: patching windows often leave a dangerous gap. Even when vendors release fixes on time, real-world attacks can start immediately—and organizations slow to update become easy prey. It’s crucial not just to patch, but to monitor for threat intelligence, apply patches rapidly (especially when KEV-listed), and conduct post-patch verification to confirm the vulnerabilities are closed. Watch also for future advisories: if threat actor attribution or exploit methodologies become known, that could reshape mitigation strategies and threat prioritization going forward.
