Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include two security flaws in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder. These vulnerabilities, CVE-2026-20127 and CVE-2026-76418, respectively, have been actively exploited in the wild, according to Cisco's advisory.
The CVSS scores for these vulnerabilities are 10.0 and 8.6, respectively. While the exact methods of exploitation are unknown and no specific threat actor has been identified, the vulnerabilities are undoubtedly being leveraged for malicious purposes. Federal Civilian Executive Branch (FCEB) agencies are urged to apply the available patches by November 24, 2026, to safeguard their networks.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
