Hackers Begin Exploiting Critical Vulnerability in Cisco BroadWorks
The Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a vulnerability in the Cisco BroadWorks platform, used by telecommunications operators and cloud communications service providers.
The issue has been assigned the identifier CVE-2026-20320 and is related to improper handling of XML requests. It allows attackers to remotely obtain sensitive configuration data from vulnerable systems without authorization using specially crafted messages.
Cisco released a patch back in August, yet attacks continue. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and mandated U.S. federal agencies to remediate the issue by November 24. Other organizations are also advised to prioritize installing the updates.
According to Malbear Labs, one Chinese-speaking threat actor exploited the vulnerability in conjunction with a compromised DeepSeek Flash artificial intelligence model. The targets included a European telecommunications operator and 13 organizations using its data centers and cloud infrastructure.
During the attack, the threat actor gained access to private keys and SSL credentials of BroadWorks servers. Specifically, the system identification key, used for authenticating platform components, was extracted. Its compromise allows attackers to impersonate the XSP server during internal system interactions.
According to CISA statistics, since November 2021, the agency’s catalog of actively exploited vulnerabilities has included 103 security issues related to Cisco products. Seven of these have also been used by ransomware operators.
