Cisco has issued a security alert for a serious XML External Entity (XXE) injection vulnerability in several components of its BroadWorks platform that lets unauthenticated remote attackers read sensitive configuration files. The flaw, assigned CVE-2026-20320 and rated 7.5 in severity, stems from the Open Client Interface (OCI) XML Parser allowing external entity resolution by default. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
Officially disclosed on August 19, 2026, the issue is classified under CWE-611: improper restriction of XML external entity reference. The vulnerability enables attackers to send malicious XML messages to the OCI-Provisioning (OCI-P) service to force the parser to load files or resources it shouldn’t. Because authentication isn’t required, systems with OCI-P exposed to untrusted networks are particularly at risk. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
What’s Affected & Risk Details
The affected BroadWorks products include the Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. Any system running a BroadWorks release older than RI.2026.07 is vulnerable. The fix is included in version RI.2026.07. For the Application Delivery Platform, the update covers both the Open Client Server and OCIOverSoap components. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
The type of attack described here is an out-of-band blind XXE. That means the attacker may not receive the contents of the targeted file directly via the app’s response. They can, however, cause the target system to send file contents to an attacker-controlled server, or leak information via side-channels. The vulnerability gives the BroadWorks process its existing user permissions, meaning any files accessible by BroadWorks are in play. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
Mitigation & Guidance
Cisco emphasizes there’s no temporary workaround; fixing the issue requires updating to the patched RI.2026.07 release. Systems exposed to untrusted networks should restrict access to OCI-P and expose it only via trusted, segmented networks or behind stringent firewall policies. Administrators should also monitor for irregular XML requests, unexpected outbound connections, or attempts to reach local files or internal services. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
At the time of the advisory, Cisco’s Product Security Incident Response Team (PSIRT) reports no known active exploitation in the wild. The vulnerability was discovered and reported by researcher Sandesh M. Gawai. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
Updating BroadWorks installations to RI.2026.07 is the only reliable way to neutralize this vulnerability. Since OCI-P has elevated access and sits at a sensitive juncture of the BroadWorks stack, let alone the lack of authentication needed to exploit this issue, impacted organizations should act immediately. ([cybersecuritynews.com](https://cybersecuritynews.com/cisco-external-entity-injection-vulnerability/))
Analysis: This XXE flaw underscores recurring risks in handling XML parsers and default-enabled external entity resolution — problems that have led to serious breaches in the past. For enterprises relying on BroadWorks, the window for exposure is wide due to the vulnerability’s severity and unauthenticated access. Going forward, companies must re-audit all services that parse XML, especially those exposed to public or semi-trusted networks, and adopt safer defaults. Keep an eye on spectrum of attack patterns emerging for blind XXE — detection strategies may need updating.
