CISA Flags Active Exploitation of Cisco BroadWorks and Openwave Flaws
Federal agencies face a November 24 deadline to patch two flaws that attackers are already using, even though fixes have been available.
CISA has added two flaws in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, pointing to active attacks even though patches already exist. The Cisco BroadWorks flaw, CVE-2026-20320, lets an unauthenticated remote party read sensitive configuration data by sending a crafted XML message to the OCI-P provisioning service, and it was fixed in release RI.2026.07. The Openwave flaw, CVE-2026-111793, lets an authenticated user convert document types that administrators meant to block, and it was fixed in version 1.1.22.0. Malbear Labs said a Chinese-speaking actor has been exploiting the BroadWorks bug in a campaign against a European telecoms provider, and that at least 13 organizations using its services may have been targeted. Federal agencies were given until November 24 to apply the patches.
Why it matters
Telecoms providers and their customers are the people most directly exposed. Malbear Labs reports that a Chinese-speaking actor has targeted a European telecoms provider through the BroadWorks flaw, and that at least 13 organizations using that provider's services may have been hit. Anyone running BroadWorks or Openwave Webtop Media Transcoder without the fixed releases is left open to a flaw that is already being exploited, so the gap between a patch existing and being applied is now the risk.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.