The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security vulnerabilities affecting Cisco BroadWorks and the Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog. The agency’s inclusion of these flaws indicates that they are currently being leveraged in active, real-world attacks. Organizations utilizing these platforms are being urged to prioritize remediation efforts to prevent unauthorized access or system compromise.
The vulnerability identified in Cisco BroadWorks, tracked as CVE-2026-20320, carries a CVSS severity score of 7.5. According to the reported details, the flaw involves an improper restriction of XML external entity (XXE) references. This class of vulnerability typically occurs when an application processes XML input from an untrusted source without properly configuring the XML parser to disable external entity resolution. By injecting malicious XML, an attacker can often force the application to disclose sensitive internal files, perform server-side request forgery, or conduct denial-of-service attacks.
The inclusion of the Openwave Messaging Webtop Media Transcoder in the KEV catalog highlights a parallel risk for enterprise messaging infrastructure. Products in this category commonly handle complex media processing tasks, which often require parsing various file formats and protocols. When these parsers are not sufficiently hardened against malformed input, they can become vectors for remote code execution or unauthorized data exposure, necessitating rigorous input validation and the regular application of security patches.
For organizations managing these specific technologies, the standard mitigation path involves applying the vendor-supplied patches that address these identified weaknesses. In instances where immediate patching is not feasible, security teams typically look to implement compensating controls, such as deploying web application firewalls or intrusion detection systems configured to identify and block the specific patterns associated with the exploit. Restricting network access to these services and ensuring that the underlying infrastructure follows the principle of least privilege are also standard practices for reducing the potential impact of such vulnerabilities.
The active exploitation of these flaws underscores the persistent challenge of patch management in enterprise environments. Even when fixes are made available by vendors, the window between disclosure and widespread exploitation remains narrow. As threat actors continue to target critical infrastructure and communication platforms, the reliance on centralized vulnerability catalogs like the KEV serves as a vital signal for security operations centers to prioritize their remediation efforts against the most immediate and verified threats.
