Cisco BroadWorks Vulnerability Allows Sensitive Data Disclosure via XML Injection
A critical XML External Entity injection vulnerability in Cisco BroadWorks, CVE-2026-20320, allows unauthenticated attackers to read sensitive configuration data and files.
Cisco has issued security updates for a high-severity XML External Entity (XXE) injection vulnerability affecting its BroadWorks platform. The flaw, tracked as CVE-2026-20320, carries a CVSS score of 7.5 and allows unauthenticated remote attackers to read sensitive configuration data and files from compromised systems.
The vulnerability resides within the Open Client Interface XML Parser, identified under CWE-611, which pertains to improper restriction of XML external entity references. Cisco's advisory, cisco-sa-bworks-xxe-uwUd7CEt, published on August 19, 2026, details that the issue stems from the affected XML parser's default behavior of allowing external entity resolution. This means that when XML input is processed, external entities can be instructed to retrieve local resources or access other available locations, potentially exposing information that should remain protected.
Attackers can exploit this vulnerability by sending a specially crafted XML message to the Open Client Interface Provisioning (OCI-P) service. Crucially, the exploitation does not require any form of authentication or user interaction, significantly increasing the risk for any BroadWorks deployments that are accessible over a network.
A successful attack could enable a threat actor to view sensitive files from the filesystem, leveraging the permissions assigned to the Cisco BroadWorks user. The vulnerability is described as an out-of-band blind XXE, meaning that attackers may not receive the target file contents directly in the application's response. Instead, the vulnerable server can be manipulated to send data or interaction results to an external system controlled by the attacker.
The affected products include Cisco BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform. Systems running releases prior to RI.2026.07 are considered vulnerable across these product families. Cisco has addressed the vulnerability in BroadWorks RI.2026.07, with fixes specifically applied to the Open Client Server and OCIOverSoap components for the Application Delivery Platform.
Organizations utilizing impacted releases are strongly advised to identify systems that expose or utilize OCI-P and upgrade to the appropriate fixed software release as soon as possible. Cisco explicitly states that no workaround is available, emphasizing the necessity of upgrading for full remediation. Administrators should also review the network exposure of BroadWorks management and provisioning interfaces, ensuring that OCI-P is not broadly accessible from untrusted networks.
Recommended security practices include limiting access through network segmentation, implementing robust firewall policies, and maintaining tightly controlled administrative paths. Security teams should monitor for unusual XML requests, unexpected outbound connections originating from BroadWorks infrastructure, and any suspicious attempts to access local files or internal network services. At the time of publication, Cisco PSIRT indicated no awareness of public announcements or active malicious exploitation of CVE-2026-20320. The vulnerability was reported by security researcher Sandesh M Gawai.