If you manage BroadWorks voice infrastructure, check who can reach its provisioning service. CISA now lists a flaw that can expose sensitive files without a login.
What changed on November 10, 2026
CISA added CVE-2026-20320 to KEV. November 24, 2026 is the federal deadline. Cisco’s August 19, 2026 advisory, cisco-sa-bworks-xxe-uwUd7CEt, rates it High, CVSS 3.1 7.5. The Cisco page remains at v1.0 and says PSIRT was unaware of malicious use. The newer CISA listing is evidence of known exploitation. Last verified November 10, 2026.
Affected releases and fix
Cisco lists Application Delivery Platform (Open Client Server and OCIOverSoap), Application Server, Profile Server and Xtended Services Platform earlier than RI.2026.07. RI.2026.07 is the first fixed release for each. A remote attacker needs access to OCI-P and could read files accessible to the BroadWorks service account without authenticating. Cisco lists no workaround.
Suggested MSP priority · urgent for reachable OCI-P
Inventory the four components and validate OCI-P reachability from internet and tenant networks. Restrict access to known provisioning peers where feasible during rollout. Upgrade affected components to a fixed release, then verify each build and run a normal provisioning check. If exposure or suspicious activity is identified, preserve logs, review what the service account could read and follow incident response for any credentials that may have been exposed.