Cisco patches BroadWorks flaw exposing sensitive files
Cisco has released security updates for a high-severity BroadWorks vulnerability that could allow unauthenticated remote attackers to read sensitive configuration files from affected systems. The flaw, tracked as CVE-2026-20320, affects the Open Client Interface XML parser used by Cisco BroadWorks, a communications platform widely deployed by service providers for cloud calling and unified…
Cisco has released security patches addressing a high-severity vulnerability affecting its BroadWorks communications platform. This flaw, designated CVE-2026-20320, exposes sensitive configuration files to unauthenticated remote attackers due to an improper XML parsing mechanism within the Open Client Interface. The vulnerability, categorized under CWE-611, stems from the default enabling of external entity resolution, allowing attackers to craft XML messages that direct the application to access unauthorized files.
The issue impacts BroadWorks Application Delivery Platform releases prior to RI.2026.07, including Open Client Server, OCIOverSoap, BroadWorks Application Server, Profile Server, and Xtended Services Platform. Cisco has released RI.2026.07 to rectify the issue, advising customers to upgrade to this version as no workarounds are available.
The attack vector is particularly concerning as it is network-accessible and does not require user interaction or credentials, with a low attack complexity and a focus on confidentiality rather than system integrity or availability. Cisco learned of the vulnerability from security researcher Sandesh M Gawai, and no exploitation was known when the advisory was released on August 19.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
