Title: CISA Flags Cisco BroadWorks XXE and Openwave Webtop Transcoder Bugs as Exploited in the Wild
Summary: On November 10, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The first is CVE-2026-20320 in Cisco BroadWorks: an improper restriction of XML external entity reference (CWE-611) in the OCI XML parser that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system; Cisco fixed it in August 2026. The second is CVE-2026-111793 in Openwave Messaging’s Webtop Media Transcoder: an incorrect resource transfer between spheres (CWE-669) that may allow an authenticated user to process and convert unintended document types by bypassing the Webmail experience; it was fixed in October 2026. Both entries carry a due date of November 24, 2026, the deadline for US federal agencies under CISA’s Binding Operational Directive 26-04, which requires patching KEV-listed flaws (or discontinuing use where mitigations are unavailable) and, for some entries, forensic triage. Neither flaw is marked as known to be used in ransomware campaigns. BroadWorks and Webtop are telecom and webmail infrastructure often run on Linux servers and frequently internet-facing, so operators should confirm their builds are on the August 2026 (BroadWorks) and October 2026 (Webtop) fixed releases or take the systems offline.
References: