The flaw, tracked as CVE-2026-20320, affects the Open Client Interface XML parser used by Cisco BroadWorks, a communications platform widely deployed by service providers for cloud calling and unified communications. It carries a CVSS severity score of 7.5 out of 10 and has been classified under CWE-611, which covers improper restriction of XML External Entity references.
The vulnerability stems from the way BroadWorks parses XML entries. External entity resolution is enabled by default, creating conditions in which specially constructed XML content can direct the application to access files that should not be exposed to a remote party.
An attacker does not need authentication to exploit the weakness. A crafted XML message sent to the Open Client Interface-Provisioning, or OCI-P, service could trigger the vulnerable parser and cause the system to access files on its local filesystem.
Successful exploitation could expose sensitive information with the permissions available to the Cisco BroadWorks user account under which the affected process operates. The exact information obtainable would therefore depend partly on the configuration and privileges assigned within each deployment.
The vulnerability affects BroadWorks Application Delivery Platform releases earlier than RI.2026.07. For that platform, the affected components include Open Client Server and OCIOverSoap. BroadWorks Application Server, Profile Server and Xtended Services Platform releases earlier than RI.2026.07 are also vulnerable.
Cisco has fixed the issue in RI.2026.07 across the affected BroadWorks products and is advising customers to move to an appropriate corrected release. There are no software configuration changes or temporary workarounds that fully address the vulnerability, making installation of the fixed version the primary remediation measure.
The attack vector is considered particularly significant because it is network-accessible and requires neither user interaction nor valid credentials. Its CVSS vector also indicates low attack complexity. The vulnerability primarily threatens confidentiality rather than the integrity or availability of affected systems, meaning exploitation is designed to expose information rather than alter data or directly disrupt services.
XML External Entity, or XXE, vulnerabilities arise when applications process XML documents containing references to external resources without adequate restrictions. Depending on the application and operating environment, attackers can potentially use such flaws to retrieve local files, interact with internal services or disclose system configuration information.
The BroadWorks weakness has been described as an out-of-band blind XXE injection issue. Blind variants can make exploitation less immediately visible because an attacker does not necessarily receive the targeted data directly within the normal application response. Data may instead be obtained through secondary interactions controlled by the attacker, depending on the exploitation technique and network configuration.
No malicious exploitation of CVE-2026-20320 was known to Cisco when its security advisory was published on August 19. The company also said it was unaware of public announcements concerning exploitation of the flaw at that time.
The vulnerability was reported to Cisco by security researcher Sandesh M Gawai and is associated internally with Cisco bug identifier CSCwv48590.
Its disclosure formed part of Cisco’s August security update cycle, which addressed vulnerabilities across several enterprise products. Those releases included fixes covering BroadWorks, Crosswork, Secure Workload, Unified Intelligence Center, RoomOS, Industrial Ethernet switches and contact-centre platforms.
Cybersecurity authorities have subsequently urged organisations running affected Cisco products to review their software versions and install the available updates. The BroadWorks exposure is particularly relevant to telecommunications and managed communications environments because the platform provides infrastructure for voice, messaging and collaboration services.
BroadWorks administrators face an additional operational consideration because the absence of a workaround limits alternatives for systems that cannot immediately be upgraded. Organisations may need to assess exposure of the OCI-P service, review access controls around management and provisioning interfaces, and monitor network activity while arranging the software update.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
