XML External Entity injection in Cisco Systems, Inc products - CVE-2026-20320
Published: August 19, 2026
Vulnerability identifier: #VU144385
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20320
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper restriction of xml external entity reference in Open Client Interface (OCI) XML Parser when processing crafted XML messages sent to the Open Client Interface - Provisioning (OCI-P) service. A remote attacker can send a crafted XML message to disclose sensitive information.
A successful exploit could allow access to sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
Affected software
BroadWorks Application Delivery Platform
BroadWorks Application Server
BroadWorks Profile Server
BroadWorks Xtended Services Platform
BroadWorks Application Server
BroadWorks Profile Server
BroadWorks Xtended Services Platform
How to mitigate CVE-2026-20320
Install security update from vendor's website.
BroadWorks Application Delivery Platform - update to RI.2026.07
BroadWorks Application Server - update to RI.2026.07
BroadWorks Profile Server - update to RI.2026.07
BroadWorks Xtended Services Platform - update to RI.2026.07
BroadWorks Application Server - update to RI.2026.07
BroadWorks Profile Server - update to RI.2026.07
BroadWorks Xtended Services Platform - update to RI.2026.07