Science & Tech · Cybersecurity · 2 hrs ago
CISA Flags Exploited Cisco BroadWorks and Openwave Flaws
CISA added two actively exploited flaws to its security list on November 10.
One affects Cisco BroadWorks, used by telecommunications providers, and the other affects Openwave Messaging’s Webtop Media Transcoder, which handles document conversion for webmail.
The Cisco flaw can let an unauthenticated remote attacker read sensitive configuration information by sending a crafted message to a service that processes XML.
The Openwave flaw can let an authenticated user convert document types that should be restricted, potentially exposing sensitive information.
Both flaws have patches available, and CISA has told US federal agencies to install them by November 24.
One account describes a campaign against a European telecom provider and its customers that may have targeted at least 13 organizations, while another says details of real-world exploitation remain unclear.
Patching is the next step for federal agencies to reduce the risk of attackers using these weaknesses.
CISA added vulnerabilities in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
The Cisco flaw could let an unauthenticated remote attacker read sensitive configuration information.
The Openwave flaw could let an authenticated user convert unintended document types by bypassing the webmail experience.
SecurityWeek reported details of exploitation campaigns, while The Hacker News said the real-world methods and perpetrators had not been identified.
Federal civilian agencies were advised to apply patches by November 24, 2026.
- Who
- CISA added the flaws to its Known Exploited Vulnerabilities catalog. Threat actors are reported to be exploiting them.
- What
- Two patched vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder were added to the catalog.
- When
- CISA added them on November 10, 2026.
- Where
- The vulnerabilities affect Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder.
- Why
- CISA cited evidence of active exploitation and urged agencies to patch the flaws.
SecurityWeek account
The Hacker News account
Exploitation details
SecurityWeek account
SecurityWeek reported that a Chinese-speaking threat actor exploited the Cisco flaw in a campaign targeting a European telecommunications provider and its customers.
The Hacker News account
The Hacker News said there were no details on how either flaw was being exploited in real-world attacks.
Attribution
SecurityWeek account
SecurityWeek described the Cisco campaign as involving a Chinese-speaking threat actor.
The Hacker News account
The Hacker News said the vulnerabilities had not been attributed to a specific named threat actor or group.
The Cisco BroadWorks vulnerability was disclosed.
The Openwave vulnerability was disclosed.
A CVE record for the Openwave vulnerability was published.
Malbear Labs warned that a threat actor was exploiting the Cisco vulnerability in a campaign targeting a European telecommunications provider and its customers.
Japan JVN flagged the Openwave weakness as exploited.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
- Cisco CVE
- CVE-2026-20320
- Openwave CVE
- CVE-2026-111793
- Cisco patch
- BroadWorks version RI.2026.07
- Openwave patch
- Webtop Media Transcoder version 1.1.22.0
- Federal agency deadline
- November 24, 2026
3 sources
What people are saying
This may allow an authenticated user to process and convert unintended document types if bypassing the webmail experience
This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default.