Cisco External Entity Injection Vulnerability Allows Attackers to Read Sensitive Data
Cisco has released security updates for a high-severity XML External Entity injection vulnerability in Cisco BroadWorks that could allow unauthenticated remote attackers to read sensitive configuration data and files from affected systems. Tracked as CVE-2026-20320, the issue carries a CVSS score of 7.5 and affects several components of the BroadWorks platform. The vulnerability, identified in \[…\] The post Cisco External Entity Injection Vulnerability Allows Attackers to Read Sensitive Data appeared first on Cyber Security News.
Cisco has released security updates for a high-severity XML External Entity injection vulnerability in Cisco BroadWorks that could allow unauthenticated remote attackers to read sensitive configuration data and files from affected systems.
Tracked as CVE-2026-20320, the issue carries a CVSS score of 7.5 and affects several components of the BroadWorks platform. The vulnerability, identified in the Open Client Interface XML Parser, is classified as CWE-611, or improper restriction of XML external entity reference.
Cisco published the advisory, cisco-sa-bworks-xxe-uwUd7CEt, on August 19, 2026. Cisco said the flaw exists because the affected XML parser allows external entity resolution by default.
When XML input is processed, external entities can instruct the parser to retrieve local resources or access other available locations. This behavior can expose information that should not be reachable through the XML interface.
An attacker could exploit the vulnerability by sending a specially crafted XML message to the Open Client Interface Provisioning service, also known as OCI-P.
Successful exploitation does not require authentication or user interaction, increasing the risk for exposed or reachable BroadWorks deployments.
Cisco External Entity Injection Vulnerability
-------------------------------------------------
Cisco warned that a successful attack could allow the threat actor to view sensitive files from the filesystem using the permissions assigned to the Cisco BroadWorks user. The advisory specifically describes the issue as an out-of-band blind XML External Entity injection vulnerability.
In a blind XXE attack, the attacker may not receive the target file contents directly in the application response. Instead, the vulnerable server can be induced to send data or interaction results to an attacker-controlled external system.
The affected products include Cisco BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform.
Systems running releases earlier than RI.2026.07 are affected across these product families, according to Cisco. Cisco has addressed the vulnerability in BroadWorks RI.2026.07. For the BroadWorks Application Delivery Platform, the fix applies to Open Client Server and OCIOverSoap components.
Organizations using impacted releases should identify systems that expose or use OCI-P and upgrade to the appropriate fixed software release as soon as possible.
No workaround is available. Cisco recommends upgrading rather than relying on temporary mitigations, as a fixed release is required to remediate the issue fully. Administrators should also review network exposure for BroadWorks management and provisioning interfaces.
OCI-P should not be broadly accessible from untrusted networks, and organizations should limit access through network segmentation, firewall policies, and tightly controlled administrative paths.
Security teams can monitor for unusual XML requests, unexpected outbound connections from BroadWorks infrastructure, and suspicious attempts to access local files or internal network services.
Cisco PSIRT said it was not aware of public announcements or malicious exploitation of CVE-2026-20320 at the time of publication. Security researcher Sandesh M Gawai reported the vulnerability.
*Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC*
The post Cisco External Entity Injection Vulnerability Allows Attackers to Read Sensitive Data appeared first on Cyber Security News.