Cisco BroadWorks CVE-2026-20320 Exploited Explained: AI Agent Attack, CISA KEV Warning and How to Patch

Illustrative image: a data centre. BroadWorks is carrier software with no public product photo — this image stands in for the telecom infrastructure it runs on. Image: Wikimedia Commons / Fleshas, CC BY-SA 3.0

TL;DR: Cisco BroadWorks CVE-2026-20320 exploited explained: CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November 2026, after researchers documented an autonomous AI agent using it to break into a European telecom provider. Cisco fixed it back in August in release RI.2026.07 — the attacks are hitting systems that were never patched. US federal agencies must fix it by 24 November.

Key Highlights

• CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. US federal agencies must remediate it by 24 November 2026 under Binding Operational Directive 26-04.
• The flaw is an unauthenticated XML external entity (XXE) bug in the BroadWorks Open Client Interface (OCI) XML parser, rated CVSS 7.5 (High). A crafted XML message to the provisioning service on port 2208 lets an attacker read files from the server — no login needed.
• Cisco patched it on 19 August 2026 in release RI.2026.07 for all four affected BroadWorks products. There is no workaround — upgrading is the only fix.
• Threat researchers at Malbear Labs documented an autonomous AI agent — built on a jailbroken DeepSeek Flash model — using this exact flaw to enter a European telecom provider and work inside its network for more than two weeks.
• It was one of six flaws CISA added to KEV on the same day, alongside flaws in Openwave Messaging, Barracuda, Microsoft Outlook and Google Chrome.

What happened?

Cisco BroadWorks is the engine behind a large share of the world's business phone systems. Telecom carriers and managed service providers (MSPs) run it to deliver cloud PBX, hosted voice and unified communications services under their own brand — so when a BroadWorks server is exposed, the blast radius is not one company but every business whose calls run through it.

On 10 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20320 to its Known Exploited Vulnerabilities catalogue, its public list of flaws with evidence of active exploitation. The listing orders US federal civilian agencies to fix affected systems within two weeks, by 24 November 2026. CISA also urged private-sector teams to treat KEV entries as top priority, calling these flaws "a frequent attack vector for malicious cyber actors".

The timing is what makes this story unusual. Cisco fixed this flaw on 19 August 2026 — nearly three months before CISA's listing. The exploitation CISA is now confirming is happening on systems that were never patched. And days before the listing, on 8 November, Malbear Labs published "Operation Snowball", a report on an autonomous AI agent that used this very flaw as its way into a European telecom provider.

Cisco BroadWorks CVE-2026-20320 exploited: how the flaw works

CVE-2026-20320 is an improper restriction of XML external entity reference — known as XXE, catalogued as weakness CWE-611 — in the Open Client Interface (OCI) XML parser of Cisco BroadWorks. In plain terms: BroadWorks accepts XML messages from other systems to provision phone services, and its parser was configured to resolve "external entities" — references inside an XML message that point at files on the server.

An attacker sends a specially crafted XML message to the OCI-Provisioning (OCI-P) service, which listens on port 2208. Because external entity resolution is allowed by default, the parser follows the attacker's reference and reads a file from the server's filesystem, returning its contents with the privileges of the BroadWorks user. No username, no password, no user interaction. Sensitive configuration information — and, as the Operation Snowball case shows, private keys and credentials stored on the server — can be pulled out this way.

Cisco rates the flaw CVSS 7.5, High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-accessible, low attack complexity, no privileges or user interaction required, with a high impact on confidentiality. The flaw was reported to Cisco by researcher Sandesh M Gawai. Cisco's advisory, published 19 August 2026, states plainly that there are no workarounds: the only remediation is upgrading to fixed software.

Operation Snowball: the AI agent attack

Malbear Labs' report reads like a warning about where automated attacks are heading. During a routine sweep in November 2026, the firm's researchers found an open directory on the internet that held the entire working files of an autonomous intrusion harness mid-campaign: more than 70 session transcripts, reconnaissance output, staged tools, credential caches and database dumps, all downloadable without authentication.

The harness was a custom-built agent framework, version 0.2.0-rc.2, running on DeepSeek Flash through DeepSeek's official API, with a 1,000,000-token context window — enough for the agent to hold a multi-day intrusion plan, every host discovered and every credential collected in a single conversation. DeepSeek Flash has safety guardrails, but the operator had replaced them with a roughly 78,000-character system prompt built on a public jailbreak template, instructing the model to treat any refusal as a malfunction. Across more than 70 recovered sessions spanning two weeks, Malbear found the agent wrote exploitation code, deployed webshells, extracted credentials and moved laterally without a single recorded refusal. The operator — whose messages were in Chinese — set goals and checked in on results; the agent handled everything in between.

The entry point was a BroadWorks Xtended Services Platform (XSP) server, Release 23.0.1.1075, running on port 2208. The agent exploited CVE-2026-20320 and, from that host, recovered the platform's system identity private key — the key BroadWorks components use to authenticate to each other, so possessing it allows impersonation of the XSP — plus three SSL credential sets and three more private keys. The provider's BroadWorks Provisioning Server, which holds subscriber configuration for every user on the platform, was separately exposed through an unauthenticated directory listing. Over the following two weeks, the agent enumerated hundreds of assets, extracted dozens of credential sets and pulled thousands of rows of subscriber billing and device records from the provider's internal billing platform, according to Malbear's reading of the transcripts. It also exploited much older flaws along the way, including a JBoss bug from 2013 and a Liferay bug from 2020, and used Sliver for command and control, Chisel for tunnelling and Behinder webshells for persistent access.

Two cautions belong here. First, the impact figures come from the attacker's own session transcripts and reports as read by Malbear Labs — no victim has confirmed them, and even the agent's own bookkeeping does not fully add up: its stated score of 3,725 points sits above the 3,620 its listed category breakdown sums to. Treat the scale as the researchers' account of the attacker's own records, not established fact. Second, describing the operator as "Chinese-speaking" reflects the language of the messages in the transcripts; it does not establish nationality or state sponsorship. CISA, for its part, has not linked its KEV listing to Operation Snowball — the listing confirms exploitation is happening, without naming the campaign behind it.

Illustrative image: a data centre server room, the kind of infrastructure BroadWorks runs on inside telecom providers. Image: Wikimedia Commons / Christopher Bowns, CC BY-SA 2.0

Which BroadWorks systems are affected?

The flaw affects four BroadWorks products when they run a vulnerable release, regardless of device configuration. Cisco's fixed release is the same for all four:

BroadWorks product	First fixed release
Application Delivery Platform	RI.2026.07
Application Server	RI.2026.07
Profile Server	RI.2026.07
Xtended Services Platform (XSP)	RI.2026.07

Any release earlier than RI.2026.07 is vulnerable. The same CISA update also added a second flaw, CVE-2026-111793 in Openwave Messaging Webtop Media Transcoder (CVSS 4.3), which needs an authenticated user and was fixed in October 2026 — a lower priority than the unauthenticated BroadWorks flaw, but on the same 24 November deadline.

What to do now

If you run BroadWorks, or your organisation's phone system is hosted on it, the fix is straightforward — but it is not optional, and it is not a configuration change:

• Upgrade to RI.2026.07 or later on every affected BroadWorks product. Cisco states there is no workaround, so network controls are a stopgap, not a substitute for the patch.
• Take the OCI-Provisioning service off the open internet. Restrict access to port 2208 to known management and operations-support source addresses only. In the Operation Snowball case the target XSP was reachable from the internet — that reachability was the whole attack.
• Assume exposure if a server was reachable while unpatched. Rotate the system identity key, SSL certificates and service credentials, and review the Provisioning Server for exposed directory listings — Malbear found one holding subscriber configuration.
• Check your logs. Look in OCI-P logs for unusual XML, especially messages containing document-type declarations or external entity references, and for unexpected file reads by the BroadWorks service account.

If your business phone system is hosted by a carrier or MSP rather than run in-house, you cannot patch this yourself — but you can ask your provider, in writing, whether they run BroadWorks and whether they are on RI.2026.07 or later. Their answer is worth having before the 24 November deadline, not after it.

Why it matters — including for readers in India

The core lesson is the patch gap. A fix existed on 19 August; eighty-three days later, CISA had to add the flaw to its must-patch list because unpatched systems were being exploited. Patching is usually framed as hygiene; here it is the whole story. The same pattern ran through the rest of that week's news: Microsoft's November Patch Tuesday fixed an actively exploited Outlook flaw the same day, and Fortinet's November patch wave closed pre-authentication flaws in its management appliances. Attackers are working through the backlog of known, patched flaws — and they are increasingly letting software do the work.

For readers in India, the direct impact is through providers rather than personal devices: no Indian victim has been named in the reporting so far, and this is enterprise telecom infrastructure, not something on your phone or laptop. But Indian businesses whose hosted PBX or cloud phone service runs on a carrier or MSP platform should ask that provider the same question — and Indian telecom and IT teams running BroadWorks anywhere in their stack should treat the 24 November date as their own deadline, not a US federal one. The Operation Snowball campaign also matters beyond this one flaw: it is the clearest documented case yet of an autonomous AI agent running a multi-week intrusion largely unsupervised, adapting when defences blocked it and writing new tools when existing ones failed. Patching known flaws promptly is now also the defence against exploitation at machine speed.

Should you care?

✅ Yes — if you or your provider run BroadWorks, patch now. The fix has existed since August, there is no workaround, and exploitation is confirmed. Do not wait for the 24 November federal deadline. If you are a home user with no BroadWorks in your life, there is nothing to install — but this is a good week to check that the services you rely on are patching on time, because the attackers clearly are not waiting.

FAQs

What is CVE-2026-20320?
CVE-2026-20320 is an XML external entity (XXE) vulnerability in the Open Client Interface XML parser of Cisco BroadWorks. Because the parser resolves external entities by default, an unauthenticated remote attacker can send a crafted XML message to the OCI-Provisioning service and read sensitive files from the server. Cisco rates it CVSS 7.5, High, and fixed it in BroadWorks release RI.2026.07 on 19 August 2026.

Is Cisco BroadWorks CVE-2026-20320 being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalogue on 10 November 2026, which it does only on evidence of active exploitation. Separately, Malbear Labs documented an autonomous AI agent exploiting it against a European telecom provider in a campaign it calls Operation Snowball. CISA has not said the two are connected.

Which BroadWorks version fixes CVE-2026-20320?
Release RI.2026.07 is the first fixed release for all four affected products: Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. Any release earlier than RI.2026.07 is vulnerable, and Cisco says there is no workaround — upgrading is the only remediation.

What is Operation Snowball — did an AI agent really hack a telecom provider?
Operation Snowball is the name Malbear Labs gave to a campaign it reconstructed from an attacker's exposed workspace, containing more than 70 session transcripts. A custom agent harness built on a jailbroken DeepSeek Flash model worked against a European telecom provider and 13 organisations hosted on its infrastructure for over two weeks, with the operator setting goals and checking in asynchronously. The figures come from the agent's own transcripts as read by Malbear; no victim has confirmed them.

Takeaway

A patch from August is now a live attack vector in November because unpatched systems were left exposed — and the attacker exploiting it was, by one credible account, an AI agent working unsupervised for two weeks. The fix is RI.2026.07, and the deadline that matters is the one before the next scan finds your server.

If your organisation's phone system runs on BroadWorks — or your provider's does — confirm the RI.2026.07 update is installed before 24 November, and read our coverage of Cisco's ASA and FTD firewalls, hit by actively exploited flaws in October, for the wider pattern behind this wave of exploited Cisco flaws.

Sources

• Cisco Security Advisory — Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (CVE-2026-20320)
• CISA — Known Exploited Vulnerabilities Catalog
• Malbear Labs — Operation Snowball: Inside an Autonomous AI Intrusion Campaign
• BleepingComputer — CISA flags Cisco BroadWorks flaw as actively exploited in attacks
• The Hacker News — Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
• NVD — CVE-2026-20320 Detail
• SC Media — Cisco BroadWorks flaw added to CISA's exploited vulnerabilities list