CISA Flags Actively‑Exploited Cisco BroadWorks XXE Flaw (CVE‑2026‑20320)

Ce qui s’est passé

CISA listed Cisco BroadWorks CVE‑2026‑20320 as actively exploited; attackers used a crafted XML payload to read private keys from the OCI parser, leveraging a jail‑broken AI model to automate attacks against a European telecom provider and its customers.

Pourquoi c’est important pour la confiance et la conformité

• The incident tests the effectiveness of vulnerability‑management and patch‑prioritization controls, a single control area that satisfies multiple framework requirements.
• Demonstrates need for continuous monitoring of KEV entries and rapid remediation evidence collection.
• Supports mapping of patch‑management controls to audit frameworks such as NIST CSF 2.0.

Who is affected

Recommended actions

1. Apply Cisco’s August 2026 patch for CVE‑2026‑20320 immediately.
2. Scan for unauthenticated directory listings on OCI‑P port 2208.
3. Update vulnerability‑management policies to treat KEV items as critical with a ≤ 14‑day remediation deadline.
4. Collect and retain patch‑deployment logs as audit evidence.