CISA added Cisco BroadWorks CVE‑2026‑20320 to its KEV catalog after confirming active exploitation that lets unauthenticated attackers read private keys. The flaw highlights the need for rapid patching and robust vulnerability‑management controls for audit readiness.
ADTP Breach Watch· November 11, 2026· BleepingComputer
SeverityHigh
Type🐛 Vulnerability
ConfidenceHigh
ReportedNov 11, 2026
TelecommunicationsTelecommunications carriersManaged service providers (MSPs)Enterprises using Cisco BroadWorks cloud PBXVulnerability ExploitOther
What happened
CISA listed Cisco BroadWorks CVE‑2026‑20320 as actively exploited; attackers used a crafted XML payload to read private keys from the OCI parser, leveraging a jail‑broken AI model to automate attacks against a European telecom provider and its customers.
Why it matters for trust and compliance
The incident tests the effectiveness of vulnerability‑management and patch‑prioritization controls, a single control area that satisfies multiple framework requirements.
Demonstrates need for continuous monitoring of KEV entries and rapid remediation evidence collection.
Supports mapping of patch‑management controls to audit frameworks such as NIST CSF 2.0.
Who is affected
Telecommunications carriersManaged service providers (MSPs)Enterprises using Cisco BroadWorks cloud PBX
Recommended actions
Apply Cisco’s August 2026 patch for CVE‑2026‑20320 immediately.
Scan for unauthenticated directory listings on OCI‑P port 2208.
Update vulnerability‑management policies to treat KEV items as critical with a ≤ 14‑day remediation deadline.
Collect and retain patch‑deployment logs as audit evidence.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.