Follow us on Google News
The United States Cybersecurity and Infrastructure Security Agency has issued an urgent warning after discovering active exploitation of two security vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder. The agency formally added both flaws to its Known Exploited Vulnerabilities catalog on Tuesday after confirming evidence of real-world attacks. Although official remediation patches were released by both vendors, threat actors continue to target vulnerable deployments, exposing organizational networks to unauthorized configuration theft and document processing manipulation.
Federal authorities noted that the targeted weaknesses allow attackers to bypass core security perimeters across affected telecommunications and enterprise messaging environments. The vulnerability in Cisco BroadWorks carries particular operational concern, as an attacker does not require prior authentication or valid system credentials to extract sensitive configuration details. The directive gives Federal Civilian Executive Branch agencies until November 24, 2026, to apply the necessary security fixes and secure their digital perimeters.
Flaws allow unauthorized data extraction and document manipulation
The Cisco BroadWorks flaw, cataloged as CVE-2026-20320, carries a CVSS score of 7.5, placing it in the high-severity tier. The vulnerability originates from improper restriction of XML External Entity references within the platform’s Open Client Interface XML Parser. An unauthenticated remote threat actor can exploit this oversight to read sensitive configuration data directly from an affected host. While the extracted material remains constrained by the operating privileges of the underlying Cisco BroadWorks system user, it grants sufficient visibility into internal network structures to facilitate subsequent attacks. Cisco originally patched the issue in August 2026.
In parallel, CISA flagged an authenticated flaw within the Openwave Messaging Webtop Media Transcoder, tracked as CVE-2026-111793 with a CVSS score of 4.3. The bug involves improper resource transfers between distinct security spheres. Exploitation requires authenticated access, allowing a threat actor to bypass standard webmail controls and force the underlying system to process and convert unauthorized documents that would typically be rejected. Openwave released a remediation update in October 2026, but ongoing active attacks prompted CISA to designate the flaw as an active operational hazard.
Attack methods and responsible threat groups remain undisclosed
Despite conclusive verification of in-the-wild exploitation, specific details surrounding the initial intrusion vectors, ongoing campaign scope, and target distribution remain limited. Public advisories have not attributed the exploitation to a specific cybercriminal organization or advanced threat group. Cisco’s own security bulletin did not reference malicious exploitation when published, indicating that real-world attacks surfaced post-disclosure.
CISA’s addition of both items to its active list signals that these flaws have progressed well beyond conceptual laboratory proof-of-concepts. Cybersecurity specialists have noted that the release of a security patch does not automatically mitigate systemic risk until enterprise administrators locate, audit, and update all affected internet-facing communications appliances and legacy messaging servers across their environments.
Alert follows critical vulnerabilities across enterprise firewalls
The latest advisory follows disclosures from last month confirming attacks on two additional enterprise products from Cisco. Those cases involved CVE-2026-20127 in Catalyst SD-WAN, which earned a maximum CVSS rating of 10.0, and CVE-2026-76418, carrying an 8.6 CVSS score, across Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense software. Both flaws were confirmed to have been actively exploited by adversaries prior to comprehensive patching.
In response to the cluster of active intrusions, cybersecurity guidance issued alongside the federal advisory urges network administrators to review all external-facing infrastructure. Best practices include disabling non-essential services, conducting rigorous perimeter asset audits, and enforcing rapid patch management cycles to prevent unpatched legacy software from serving as persistent gateways for unauthorized network intrusion.
