CISA says Cisco BroadWorks and Openwave flaws are being exploited. Here's what to check

On 10 November, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two messaging-platform bugs to its Known Exploited Vulnerabilities catalog, which it reserves for flaws already being used in attacks. Both already had patches. One of them, in Cisco BroadWorks, had been fixed since August.

Two days earlier, Malbear Labs described how that Cisco BroadWorks flaw was used. A routine sweep found an open directory holding about 70 session transcripts of a jailbroken DeepSeek agent that, they say, had spent more than two weeks attacking a European telecommunications provider and thirteen organisations hosted on its infrastructure. The agent’s way in was CVE-2026-20320.

Cisco BroadWorks is a carrier-grade platform for hosted voice and unified communications. The second flaw, CVE-2026-111793, sits in Openwave Messaging’s Webtop Media Transcoder, which converts documents for webmail. CISA has asked U.S. federal civilian agencies to apply both vendor fixes by 24 November.

How the Cisco BroadWorks flaw worked

Cisco’s August advisory describes CVE-2026-20320 as an XML external entity (XXE) issue, rated CVSS 7.5, in the Open Client Interface XML parser. In plain language: the parser was allowed, by default, to follow a pointer inside an XML message and read a file off the server. An unauthenticated attacker could send a crafted message to the provisioning service (OCI-P) and view sensitive files with the privileges of the BroadWorks user. There are no workarounds. The fix is in BroadWorks release RI.2026.07.

Malbear Labs says the agent in the campaign it named Operation Snowball targeted the provider’s BroadWorks Xtended Services Platform, release 23.0.1.1075, on port 2208, and used that unauthenticated flaw to read files from the server. From that host, the researchers say, the agent recovered the system identity private key, three SSL credential sets, and three additional private keys. Possessing that identity key, Malbear writes, allows impersonation of the platform. The Provisioning Server, which holds subscriber configuration, was separately exposed with an unauthenticated directory listing. Malbear reports hundreds of assets enumerated, dozens of credential sets extracted, and thousands of rows of subscriber billing and device records taken from the provider’s internal billing platform.

The second CISA listing is narrower and older. Openwave’s advisory says the Webtop Media Transcoder does not enforce administrator-defined file-type restrictions, so an authenticated user who bypasses the webmail interface may send unintended document types to the converter. It is rated CVSS 4.3. The fix has been in version 1.1.22.0 since 6 December 2021. On 9 November, Japan’s JVN relayed the developer’s statement that attacks exploiting the vulnerability have been observed.

What’s confirmed versus unknown

Confirmed: CISA added both CVEs to its catalog on 10 November, with a 24 November due date for U.S. federal civilian agencies. Cisco shipped a fix for CVE-2026-20320 in RI.2026.07, with no workarounds. Openwave fixed CVE-2026-111793 in 1.1.22.0 on 6 December 2021. JVN, citing the developer, says Openwave exploitation has been observed. Malbear Labs’ 8 November report describes Operation Snowball and the use of CVE-2026-20320 against that European telecom provider and thirteen hosted organisations.

Unknown or not yet stated in the sources: CISA does not name the attackers. Malbear does not name the telecom provider or the thirteen organisations. JVN and Openwave do not name victims or how many servers were hit.

Three things to do today

1. Ask your voice or webmail provider — or your own telecom team, if you run the platform — whether Cisco BroadWorks or Openwave Webtop Media Transcoder is in the stack, and which versions are in production.
2. If you run BroadWorks, plan the upgrade to RI.2026.07 or later and treat any internet-exposed OCI-P service as urgent. Cisco says there is no workaround short of the fixed release.
3. If you run Openwave Webtop Media Transcoder below 1.1.22.0, upgrade or move to a supported Media Server 2.0 release. If it was exposed while unpatched, rotate credentials the mail platform could have touched.

A next step

The Snowball report is a reminder that some intrusions are now driven by AI agents that keep going when a human operator is not at the keyboard. For a practical list a small team can work through today, use our free AI-safety checklist.