On November 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added a Cisco BroadWorks flaw, CVE-2026-20320, to its Known Exploited Vulnerabilities catalog, with a federal due date of November 24. Cisco fixed it on August 19. Two days before CISA’s listing, a security firm reported that an AI agent directed by a human operator had used it to break into a European telecommunications provider.
Most small businesses will never log in to a BroadWorks server. The security firm’s report describes BroadWorks as Cisco’s carrier-grade platform for hosted voice and unified communications services, the kind of system a phone or hosting provider runs. If your phones, or your servers, are hosted by a provider, the patch is theirs to apply and the risk is partly yours. The job this week is to ask them, in writing, and to check your own default passwords.
What happened
Cisco’s advisory, first published August 19, describes an XML external entity flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks. An unauthenticated, remote attacker can send a crafted XML message to the OCI provisioning service and read sensitive files from the system with the privileges of the BroadWorks software. Cisco rates it High, with a CVSS base score of 7.5. Four products are affected if they run a vulnerable release, regardless of configuration: BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform.
The first fixed release for all four is RI.2026.07. Cisco says there are no workarounds. Its advisory, still at version 1.0 when we checked it on November 11, says Cisco’s security team is not aware of malicious use. CISA’s catalog says otherwise: it added the CVE on November 10, based on evidence of active exploitation, as one of six additions that day. CISA lists known ransomware use as unknown.
What the security firm reported
On November 8, Malbear Labs, a threat research group, published a report it calls “Operation Snowball.” It says it found an exposed open directory holding the live workspace of an autonomous intrusion tool: more than 70 session transcripts of a jailbroken DeepSeek agent, directed by a Chinese-speaking operator, running more than two weeks of largely unsupervised attacks against a European telecommunications provider and organizations hosted in its data centers and cloud.
According to the report, the entry point was CVE-2026-20320 on the provider’s BroadWorks Xtended Services Platform, release 23.0.1.1075. From there, the report says, the agent recovered private keys and credentials, moved through internal networks using older flaws, and compiled a list of 13 organizations hosted on the provider’s infrastructure, drawn from public registry records. Among the access it claims, the report lists millions of patient records reached through a TrakCare Oracle database that still used default database credentials.
These are the firm’s findings, based on the attacker’s own transcripts and reports. Infosecurity Magazine, writing up the research, noted that the post does not say whether Malbear checked the claims with any victim, what was taken rather than staged, or whether all 13 organizations were breached. Malbear did not name the provider and says it withheld the directory’s address to protect the affected organizations.
Who is affected
Directly, any organization running one of the four BroadWorks products on a release earlier than RI.2026.07. In practice, that is mainly service providers that sell hosted calling and collaboration. Indirectly, it is their customers. The report says the provider’s BroadWorks provisioning server holds subscriber configuration for every user on the platform, and it describes an attacker using one provider as a route to the organizations hosted on it.
What it means for owners and CISOs
This is the vendor-inventory problem again. You cannot patch a provider’s platform, and you probably do not know what it runs. What you can do is ask a clear question, get a dated answer, and keep it with your vendor records. Three months passed between Cisco’s fix and CISA’s listing. A provider that patched in August has nothing to worry about and can say so in one line. A provider that cannot answer is telling you something.
The second lesson costs nothing. In the report’s account, the most damaging step was not a sophisticated exploit but a database that still had its default password. Every business has a list of devices and systems that shipped with one: printers, network gear, cameras, phone handsets, admin consoles. A tool that tries default passwords on everything it can reach is cheap to run, and the report describes an agent doing exactly that.
What to do this week
- Find out who hosts your phones and servers. List the provider for hosted voice, unified communications and any hosted servers or data center space.
- Send one written question to each. “Do you run Cisco BroadWorks for our service? If so, are all BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform systems on release RI.2026.07 or later, and on what date did you upgrade? Given CISA’s November 10 listing of CVE-2026-20320, have you reviewed those systems for signs of compromise?”
- Record the answer. Put the provider, the answer, the date and the person who replied in your vendor or risk register. Our free risk exception register works for this if the answer is “not yet.” The Renewal & Risk Operator Pack ($29) includes a spreadsheet version of that register.
- Change default passwords you own. Walk your own list: routers, firewalls, printers, cameras, desk phones, database and admin accounts. Anything still on its factory password gets changed this week, or taken off the network.
- If you run BroadWorks yourself, upgrade to RI.2026.07 or later. There is no workaround. Review OCI provisioning exposure and logs, since the flaw is reachable without a login.
What to watch next
- Cisco’s advisory. It still said “not aware of any public announcements or malicious use” on November 11. Watch for an update that reflects CISA’s listing or adds detail.
- Victim confirmation. The report’s access claims have not been confirmed by the organizations involved, as far as public reporting shows. Treat the patient-record figure as a claim until someone confirms it.
- Provider notices. If your provider runs BroadWorks and was behind on patches, you may get a notice. Read it for dates, the systems involved and what data they held about you.
Not sure how to word the question for your provider, or what a good answer looks like? Our $29 Quick Answer service covers one question like that, in writing.
Sources
- Cisco, “Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability”, cisco-sa-bworks-xxe-uwUd7CEt, first published August 19, 2026, version 1.0, checked November 11, 2026 (CVE-2026-20320, CVSS 7.5, affected products, first fixed release RI.2026.07, no workarounds, not aware of malicious use)
- CISA, “CISA Adds Six Known Exploited Vulnerabilities to Catalog”, November 10, 2026
- CISA Known Exploited Vulnerabilities catalog, checked November 11, 2026, catalog version 2026.11.10 (CVE-2026-20320 added November 10, due November 24, known ransomware use Unknown)
- Malbear Labs, “Operation Snowball: Inside an Autonomous AI Intrusion Campaign”, November 8, 2026 (the security firm’s report; entry through CVE-2026-20320; 13 organizations; default database credentials)
- Infosecurity Magazine, write-up of Operation Snowball (notes the claims were not confirmed with victims)
Related: PHP2Shell and the vendor inventory, the OpenSSH password bypass due November 12, and Security and vulnerabilities, every security briefing, guide and tool in one place.
Follow Circuit & Capital on Bluesky, Facebook and X (@circuitsfit) for new briefings.