CVE-2026-20320
Quick assessment
Affected
Cisco Cisco BroadWorks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco BroadWorks是美国Cisco公司的一款提供呼叫控制与PBX功能的交换机。 Cisco BroadWorks存在输入验证错误漏洞，该漏洞源于XML条目解析不当，默认允许外部实体解析，可能导致未经身份验证的远程攻击者读取敏感配置信息，并以Cisco BroadWorks用户权限查看文件系统中的敏感文件。
Possible ATT&CK Techniques 3 AI
T1059.005 · Visual Basic T1005 · Data from Local System T1552.004 · Private KeysAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco BroadWorks | N/A |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-20320
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco BroadWorks 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco BroadWorks是美国Cisco公司的一款提供呼叫控制与PBX功能的交换机。 Cisco BroadWorks存在输入验证错误漏洞，该漏洞源于XML条目解析不当，默认允许外部实体解析，可能导致未经身份验证的远程攻击者读取敏感配置信息，并以Cisco BroadWorks用户权限查看文件系统中的敏感文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco BroadWorks | N/A | - |
|
II. Public POCs for CVE-2026-20320
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20320
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-20320 (1)
Same Patch Batch · Cisco · 2026-08-19 · 15 CVEs total
| CVE-2026-20030 | 10.0 CRITICAL | Cisco Crosswork Security Hardening Release: August 2026 |
| CVE-2026-20358 | 10.0 CRITICAL | Cisco Crosswork Security Hardening Release: August 2026 |
| CVE-2026-20357 | 10.0 CRITICAL | Cisco Crosswork Security Hardening Release: August 2026 |
| CVE-2026-20317 | 10.0 CRITICAL | Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentic |
| CVE-2026-20315 | 10.0 CRITICAL | Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Co |
| CVE-2026-20231 | 9.9 CRITICAL | Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutraliz |
| CVE-2026-20359 | 9.9 CRITICAL | Cisco Crosswork Security Hardening Release: August 2026 |
| CVE-2026-20318 | 9.6 CRITICAL | Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Val |
| CVE-2026-20319 | 7.5 HIGH | Cisco Secure Workload Software Security Hardening Release August 2026 - Buffer Management |
| CVE-2026-20327 | 6.5 MEDIUM | Cisco Unified Intelligence Center SQL Injection Vulnerability |
| CVE-2026-20302 | 6.1 MEDIUM | Cisco RoomOS Stack Overflow Vulnerability |
| CVE-2026-20232 | 5.4 MEDIUM | Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability |
| CVE-2026-20177 | 5.3 MEDIUM | Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability |
| CVE-2026-20314 | 5.0 MEDIUM | Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Server- |
IV. Related Vulnerabilities
Same product: Cisco BroadWorks
-
CVE-2026-76438
Cisco BroadWorks CommPilot Application Software Authorizatio -
CVE-2025-20307
Cisco BroadWorks Application Delivery Platform Cross-Site Sc -
CVE-2025-20211
Cisco BroadWorks Application Delivery Platform Software Cros -
CVE-2025-20165
Cisco BroadWorks SIP Denial of Service Vulnerability -
CVE-2022-20948
Cisco BroadWorks Hosted Thin Receptionist Cross-Site Scripti
Same vendor: Cisco
-
CVE-2026-76472
Cisco Meraki Security Hardening Release October 2026 - Impro -
CVE-2026-76467
Cisco Meraki Software Hardening Release - Resource Lifetime -
CVE-2026-76470
Cisco Meraki Hardening Release - Incorrect Calculation Vulne -
CVE-2026-76469
Cisco Meraki Security Hardening Release: October 2026 Insuff -
CVE-2026-76468
Cisco Meraki Hardening Release - Input Validation Vulnerabil
Same weakness: CWE-611
-
CVE-2026-14905
IBM DataPower Gateway XXE -
CVE-2026-102155
Security Advisory 0190 -
CVE-2026-101893
Newell Brands DYMO ID document parsing failing file type ext -
CVE-2026-88789
Apache Camel Quarkus: Camel Quarkus: Forced Xalan Transforme -
CVE-2026-102127
Kiteworks Email Protection Gateway Improper Restriction of X
V. Comments for CVE-2026-20320
No comments yet