CVE-2026-20320 is a high-severity security vulnerability in Cisco BroadWorks, a platform widely used to deliver business calling, collaboration, and communications services. The issue can allow an unauthenticated remote attacker to access sensitive configuration information and files from an affected system. For organizations that operate BroadWorks directly, as well as service providers supporting business voice customers, this creates a meaningful confidentiality and operational risk.
Your concern is not limited to a technical server issue. Sensitive system files can contain information that helps an attacker understand your communications environment, identify service dependencies, or plan follow-on activity. That can put customer trust, service reliability, contractual commitments, and regulatory obligations at risk.
This post explains the issue in business terms, outlines who should act, and provides a practical response path. A technical appendix follows for security engineers, information technology teams, and penetration testers.
Cisco disclosed CVE-2026-20320 on August 19, 2026. The vulnerability affects the Open Client Interface XML parser in Cisco BroadWorks, specifically where the Open Client Interface Provisioning service processes XML input. Cisco assigned the vulnerability a CVSS severity score of 7.5 out of 10, categorized as High.
In plain language, the affected software may accept specially constructed data that causes it to retrieve information it should not retrieve. An attacker does not need a valid account and can attempt exploitation remotely if they can reach the relevant service. The result may be exposure of sensitive files that the Cisco BroadWorks service account can read.
Cisco identified this as an XML external entity issue, a known class of input-handling weakness. The National Vulnerability Database lists the weakness as CWE-611, or improper restriction of XML external entity references. Cisco released software updates to address the issue and states that no workaround fully resolves the vulnerability. The vendor advisory identifies the BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform as affected when running a vulnerable release.
If you run affected Cisco BroadWorks infrastructure, CVE-2026-20320 could expose information that should remain internal. That may include configuration data, service settings, integration details, file paths, and potentially other files accessible to the BroadWorks service account. Even when the initial impact is limited to reading data, that information can make later attacks more targeted and effective.
For your operations, an incident could require emergency investigation, service-provider coordination, credential review, log analysis, and customer communications. Communications systems are often business-critical, so security response work can distract teams from maintaining voice availability, provisioning users, supporting contact centers, or delivering other services.
The reputational impact can be significant. Customers expect phone, messaging, and collaboration platforms to protect service information and personal or business data. If your organization provides communications services to third parties, you may also face contractual scrutiny from customers, resellers, and technology partners.
For regulated organizations in the United States and Canada, the issue can create compliance exposure depending on the information present on the affected system. Financial institutions, healthcare providers, public-sector organizations, and managed service providers should determine whether accessible files could contain personal information, customer records, credentials, or regulated configuration data. You should treat patching, access restriction, and evidence preservation as business-risk decisions, not merely routine maintenance.
A regional bank: A regional bank uses a service provider that operates Cisco BroadWorks for branch and contact-center calling. If the provider’s provisioning interface is exposed and unpatched, an attacker could retrieve configuration information that reveals internal service architecture or integration details. The bank may need to assess customer-data exposure, validate contractual security obligations, and confirm that its provider has applied Cisco’s fixed release.
A Canadian healthcare network: A healthcare network relies on BroadWorks-based calling across clinics, scheduling teams, and support desks. Sensitive configuration files could expose information useful for attacking communications infrastructure or connected systems. Even without a confirmed patient-data disclosure, the organization could incur incident-response costs and face concerns about continuity of care and privacy safeguards.
A mid-sized managed service provider: A managed service provider hosts or administers voice services for many small-business customers. A single vulnerable BroadWorks environment may create a multi-tenant risk, because exposed configuration data can affect more than one customer relationship. The provider must quickly identify every affected deployment, restrict access to the provisioning service, and communicate a credible remediation plan.
A national retail chain: A retailer uses business voice services to connect stores, distribution sites, and customer support teams. An attacker who gains access to sensitive communications-system information may use it to target operational personnel or disrupt customer-service workflows through later attacks. Rapid remediation helps reduce the chance that a technical finding turns into a broader business interruption.
A patch is essential, but patching alone does not answer every security question. IntegSec helps organizations validate whether exposed services, configuration weaknesses, credential risks, and related attack paths could turn a known vulnerability into a material business incident. Our penetration testing engagements provide practical, evidence-driven findings and prioritized remediation guidance for leadership and technical teams. Strengthen your security posture with a focused assessment from IntegSec, and reduce cybersecurity risk before an attacker tests your environment first.
CVE-2026-20320 is an out-of-band blind XML external entity injection vulnerability in the Cisco BroadWorks Open Client Interface XML Parser. The root cause is improper parsing of XML entries because external entity resolution is permitted by default. A remote attacker can submit a crafted XML message to the Open Client Interface Provisioning service, causing the parser to resolve an external entity and expose data from files accessible to the Cisco BroadWorks user.
The affected component is the OCI XML parser used by Cisco BroadWorks provisioning functionality. The attack vector is network-based, requires low attack complexity, does not require privileges, and does not require user interaction. Cisco’s published CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, with a base score of 7.5 High. Confidentiality impact is High, while integrity and availability impacts are rated None.
The National Vulnerability Database records the weakness as CWE-611, Improper Restriction of XML External Entity Reference. NVD published the CVE on August 19, 2026, and lists Cisco Systems as the CNA.
Use authorized asset-management and administrative methods to establish whether Cisco BroadWorks is deployed and whether installed releases predate RI.2026.07. Cisco identifies the Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform as potentially affected product families.
CVE-2026-20320, Cisco BroadWorks, OCI, or Open Client Interface Provisioning service findings.Cisco software updates are the required remediation path. Cisco states that no workaround addresses CVE-2026-20320, so organizations should prioritize a supported upgrade rather than treating network controls as a permanent substitute. Cisco and third-party reporting identify BroadWorks RI.2026.07 as the fixed release for affected product families.