CiscoCVE-2026-20320
Cisco BroadWorks: XML external entity
High7.5CVE-2026-20320 · Published Aug 19, 2026 · updated Aug 20, 2026
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Cisco BroadWorks Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-611
More Cisco advisories
All Cisco| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 19 | Cisco Secure Workload: improper input validation | Critical9.6 | No fix yet |
| Aug 19 | Cisco Secure Workload: memory corruption | High7.5 | No fix yet |
| Aug 19 | Cisco Unified Intelligence Center: SQL injection | Medium6.5 | No fix yet |
| Aug 19 | Cisco Crosswork Planning: missing authentication | Critical10.0 | No fix yet |
| Aug 19 | As part of Cisco's ongoing commitment to proactive security and product quality | Critical10.0 | No fix yet |
| Aug 19 | Cisco Crosswork Planning: weakly protected credentials | Critical9.9 | No fix yet |