{"id":"EM-20261110-1E0F","url":"https://cyber.eventmonitor.net/incident/EM-20261110-1E0F/cve-2026-20320-cisco-broadworks-improper-restriction-of-xml-external-entity/","type":"cve","title":"Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability","subtitle":"CVE-2026-20320","subject":"CVE-2026-20320","status":"Confirmed","severity":"high","affected":["Cisco BroadWorks"],"headline":"0 hours from first report to confirmed exploitation.","born":"2026-11-10T12:00:00.000Z","firstSignal":"2026-11-10T12:00:00.000Z","lastSignal":"2026-11-10T12:00:00.000Z","updated":"2026-11-10T20:23:48.430Z","revision":2,"life":[{"status":"Born","at":"2026-11-10T12:00:00.000Z","why":"second independent source: C2 CISA Cybersecurity Advisories"},{"status":"Developing","at":"2026-11-10T12:00:00.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-11-10T12:00:00.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-11-10T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-11-10T12:00:00.000Z","what":"Born: second source, C2 CISA Cybersecurity Advisories. Page EM-20261110-1E0F created."},{"at":"2026-11-10T12:00:00.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"}],"stages":[{"name":"Disclosed","at":"2026-08-19T17:18:40.433Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-08-19T17:18:40.433Z","detail":"CVSS 7.5 · EPSS 0.4%"},{"name":"Exploited","at":"2026-11-10T12:00:00.000Z","detail":"C1 CISA KEV, fix by 2026-11-24"},{"name":"Advisories","at":"2026-11-10T12:00:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-11-24, then 14 quiet days"}],"signals":[{"at":"2026-11-10T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-20320 added to KEV: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability","text":"Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-11-10T12:00:00.000Z","source":"C2","sourceName":"CISA Cybersecurity Advisories","role":"Government","severity":3,"title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","text":"CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder…","url":"https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog"}],"crowd":[],"reference":{"nvd":{"published":"2026-08-19T17:18:40.433","score":7.5,"severity":"HIGH","desc":"A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.\r\n\r This vulnerability exists because XML entries are improperly parsed due to external entity…","product":"","seen":1794342228430},"kev":{"added":"2026-11-10","due":"2026-11-24","ransomware":"Unknown","vendor":"Cisco","product":"BroadWorks","name":"Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability"},"epss":{"epss":0.00385,"pct":0.32917,"at":1794342228430},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}