When a Patch Exists and Attackers Still Win

There is a particular kind of frustration in incident response that comes from watching a known, fixable vulnerability get exploited in the wild. That is the situation facing defenders this week, after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two flaws—one in Cisco BroadWorks and one in Openwave's Messaging Webtop Media Transcoder—to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

Both issues have patches available. That detail matters more than any CVSS number: the gap between patch availability and patch adoption is where these attacks live.

The Two Vulnerabilities

CVE-2026-20320 (CVSS 7.5) affects Cisco BroadWorks and stems from improper restriction of XML external entity (XXE) processing. XXE flaws arise when an XML parser is allowed to resolve external entities, which can let an attacker read local files, reach internal services, or trigger server-side request forgery against systems that trust the application. A 7.5 score places this in the high-severity band—not the highest tier, but more than enough to cause real damage in a telecom-adjacent platform like BroadWorks, which underpins voice and unified communications for many service providers and large enterprises.

The Openwave Messaging Webtop Media Transcoder flaw was added to the KEV catalog in the same update. The source report does not publish a full technical breakdown of this second issue, but its inclusion in KEV is the operative signal: CISA only lists vulnerabilities it has credible evidence are being exploited in the wild.

Why the KEV Listing Is the Real Headline

The KEV catalog is not a severity ranking. It is a list of confirmed, exploited-in-the-wild vulnerabilities, and it carries a compliance clock for U.S. federal civilian agencies, which must remediate listed flaws within a defined window. For everyone else, it functions as a prioritization shortcut: when a vulnerability lands on KEV, it moves to the top of the patching queue regardless of where it sits in a generic vulnerability scan report.

That is especially relevant here. BroadWorks and Openwave's messaging infrastructure sit in environments where uptime expectations are high, change windows are narrow, and patching often requires coordination across service provider teams. The result is predictable: fixes get deferred, and deferred fixes get exploited.

XXE: An Old Class That Keeps Paying Off

The Cisco BroadWorks issue is a reminder that XXE remains a durable attack technique. It has been documented for over a decade, and secure XML parsing guidance is widely available, yet it keeps appearing in enterprise products because XML parsing is often buried in legacy components, third-party libraries, or integration layers that receive less scrutiny than the primary application code.

Cisco has published fixes for the BroadWorks flaw. Organizations that have not yet applied them should treat this as an urgent action item rather than a scheduled maintenance task.

What Defenders Should Do Now

  1. Inventory exposure. Determine whether your organization runs Cisco BroadWorks or Openwave Messaging Webtop Media Transcoder, including in managed-service or hosted deployments where a third party may own patching. Confirm the exact version in use.
  2. Apply vendor patches. Both flaws have fixes available. Follow Cisco's and Openwave's advisories for the specific remediation steps and any configuration mitigations offered as interim measures.
  3. Hunt for exploitation signs. For the XXE flaw, review application and web server logs for anomalous outbound requests, unexpected file access errors, or XML payloads containing external entity declarations. Check for unusual egress from application servers to internal or external endpoints.
  4. Constrain egress and parser behavior. Where patching cannot happen immediately, disable external entity resolution in XML parsers and restrict outbound traffic from application servers to only what is required.
  5. Track KEV deadlines. If you operate in a regulated or federal-adjacent environment, map both CVEs to your remediation SLAs now, and document exceptions formally.

The Bigger Lesson

Neither of these vulnerabilities is exotic. One is a well-understood XXE class defect; the other is significant primarily because attackers are already using it. The common thread is that exploitation is happening against software that has a fix sitting on the vendor's website.

That is the recurring theme of KEV additions in recent years: the most exploited vulnerabilities are rarely the most sophisticated ones. They are the ones that were patched, announced, and then left running in production. Security teams that treat KEV listings as a trigger for immediate verification—rather than a footnote in a quarterly report—close that gap faster than those that don't.

For organizations running either product, the message is straightforward: confirm your exposure, apply the available patches, and check your logs for signs that someone got there first.

Original source: The Hacker News — Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches