CVE-2026-20320: Active Exploitation of Cisco BroadWorks and Openwave Messaging — Detection and Remediation Guide

---
title: XXE Exploitation Attempt in Web Server Access Logs
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects XML External Entity injection attempts in web server access logs targeting Cisco BroadWorks or Openwave Messaging endpoints. Looks for DOCTYPE declarations and ENTITY references in HTTP requests indicative of XXE payloads.
references:
  - https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/05
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '<!DOCTYPE'
      - '<!ENTITY'
      - 'SYSTEM'
      - 'file:///'
  selection_body:
    cs-body|contains:
      - '<!DOCTYPE'
      - '<!ENTITY'
      - 'SYSTEM "file:///'
      - 'SYSTEM "http://'
      - 'SYSTEM "https://'
  condition: selection_uri or selection_body
falsepositives:
  - Legitimate XML API integrations that use DOCTYPE declarations (rare in modern implementations)
  - XML schema validation tools
level: high
---
title: Suspicious File Read via Web Application Process
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects web application processes (Java, Tomcat, or similar) reading sensitive system files that are commonly targeted in XXE exploitation for data exfiltration from Linux-based Cisco BroadWorks or Openwave servers.
references:
  - https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/05
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    ProcessName|contains:
      - 'java'
      - 'tomcat'
      - 'catalina'
      - 'httpd'
      - 'nginx'
      - 'transcoder'
  selection_files:
    TargetFilename|contains:
      - '/etc/passwd'
      - '/etc/shadow'
      - '/proc/self/environ'
      - '/etc/hosts'
      - '.ssh/authorized_keys'
      - '.ssh/id_rsa'
      - 'server.xml'
      - 'context.xml'
      - 'web.xml'
      - 'catalina.properties'
      - 'database.properties'
  condition: selection_process and selection_files
falsepositives:
  - Legitimate application configuration reads during startup (baseline and filter by process start time)
  - System administration activities
level: high
---
title: Out-of-Band XXE Data Exfiltration via DNS or HTTP
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects unusual outbound DNS queries or HTTP connections from web application server processes that may indicate out-of-band XXE data exfiltration from Cisco BroadWorks or Openwave servers.
references:
  - https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/11/05
tags:
  - attack.exfiltration
  - attack.t1048
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|contains:
      - 'java'
      - 'tomcat'
      - 'catalina'
      - 'httpd'
      - 'nginx'
      - 'transcoder'
  selection_outbound:
    DestinationPort:
      - 53
      - 80
      - 443
      - 8080
      - 8443
  filter_known_destinations:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection_process and selection_outbound and not filter_known_destinations
falsepositives:
  - Legitimate software update mechanisms
  - API integrations and license validation callbacks
  - SIP trunk connectivity for BroadWorks (baseline known SIP provider IPs)
level: medium

// Hunt for XXE payload patterns in web requests to BroadWorks/Openwave endpoints
// Ingest via Syslog, CEF, or custom log table
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL contains "broadworks" or RequestURL contains "webtop" or RequestURL contains "transcoder" or RequestURL contains "media"
| where RequestURL contains "DOCTYPE" or RequestURL contains "ENTITY" or RequestURL contains "file:///"
    or (AdditionalExtensions has_any ("DOCTYPE", "ENTITY", "file:///"))
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, 
    DeviceProduct, AdditionalExtensions
| sort by TimeGenerated desc

// Hunt for outbound connections from web server processes to uncommon external destinations
// Useful for detecting out-of-band XXE exfiltration
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("java", "tomcat", "catalina", "httpd", "nginx", "transcoder")
| where SyslogMessage has_any ("connect", "outbound", "dns", "resolve")
| extend DestIP = extract(@"dest=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| where isnotempty(DestIP)
| where not(DestIP startswith "10." or DestIP startswith "172.16." or DestIP startswith "192.168.")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) 
    by DestIP, ProcessName, Computer
| sort by ConnectionCount desc

// Hunt for suspicious file access patterns by web application processes
// Ingested via Syslog with auditd or similar
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("/etc/passwd", "/etc/shadow", "/proc/self/environ", "id_rsa", "server.xml", "catalina.properties")
| where SyslogMessage has_any ("java", "tomcat", "catalina", "httpd", "nginx", "transcoder", "open")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| sort by TimeGenerated desc

// Correlate: HTTP requests with XML content-type to BroadWorks/Openwave from unusual sources
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("broadworks", "webtop", "transcoder")
| where RequestMethod == "POST"
| summarize RequestCount = count(), UniqueSourceIPs = dcount(SourceIP) by RequestURL, bin(TimeGenerated, 1h)
| where RequestCount > 100  // Adjust threshold based on your baseline
| sort by RequestCount desc

-- Hunt for web application processes with suspicious file access or network connections
-- relevant to XXE exploitation of Cisco BroadWorks / Openwave Messaging

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(java|tomcat|catalina|httpd|nginx|transcoder)'
   OR CommandLine =~ '(?i)(broadworks|openwave|webtop|transcoder)'

// Check network connections from those processes
SELECT Pid, Name, Status, SrcAddr, SrcPort, DstAddr, DstPort
FROM netstat()
WHERE Name =~ '(?i)(java|tomcat|catalina|httpd|nginx|transcoder)'
  AND Status =~ 'ESTABLISHED'
  AND NOT DstAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

// Check for recently modified config files that could indicate post-exploitation tampering
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='/opt/broadworks/**/*.xml')
WHERE Mtime > now() - 604800

SELECT FullPath, Size, Mtime, Atime  
FROM glob(globs='/etc/tomcat*/**/*.xml')
WHERE Mtime > now() - 604800

SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='/opt/openwave/**/*.properties')
WHERE Mtime > now() - 604800

#!/bin/bash
# CVE-2026-20320 — XXE Exploitation Detection and Verification Script
# For Cisco BroadWorks and Openwave Messaging servers
# Run as root or with sudo

echo "=============================================="
echo " CVE-2026-20320 XXE Exploitation Check"
echo " Date: $(date)"
echo " Host: $(hostname)"
echo "=============================================="

echo ""
echo "[*] Checking web server access logs for XXE payload patterns..."
echo ""

# Check common log locations for XXE indicators
LOG_PATHS=(
    "/var/log/httpd/access_log"
    "/var/log/httpd/access_log.1"
    "/var/log/nginx/access.log"
    "/var/log/nginx/access.log.1"
    "/var/log/tomcat*/localhost_access_log*.txt"
    "/opt/broadworks/logs/*.log"
    "/opt/openwave/logs/*.log"
)

XXE_PATTERNS=(
    "DOCTYPE"
    "ENTITY"
    "file:///"
    "SYSTEM.*http"
    "SYSTEM.*file"
)

FOUND=0
for logpath in "${LOG_PATHS[@]}"; do
    for log in $logpath; do
        if [ -f "$log" ]; then
            for pattern in "${XXE_PATTERNS[@]}"; do
                MATCHES=$(grep -ci "$pattern" "$log" 2>/dev/null)
                if [ "$MATCHES" -gt 0 ] 2>/dev/null; then
                    echo "[ALERT] Found $MATCHES matches for '$pattern' in $log"
                    grep -i "$pattern" "$log" | tail -5
                    echo "---"
                    FOUND=1
                fi
            done
        fi
    done
done

if [ "$FOUND" -eq 0 ]; then
    echo "[OK] No XXE payload patterns found in checked log files."
fi

echo ""
echo "[*] Checking for unusual outbound connections from web server processes..."

# Check for outbound connections from Java/Tomcat/httpd to external IPs
ss -tnp 2>/dev/null | grep -E '(java|tomcat|catalina|httpd|nginx|transcoder)' | while read line; do
    DEST_IP=$(echo "$line" | awk '{print $5}' | cut -d: -f1)
    if [[ ! "$DEST_IP" =~ ^10\. ]] && [[ ! "$DEST_IP" =~ ^172\.(1[6-9]|2[0-9]|3[01])\. ]] && [[ ! "$DEST_IP" =~ ^192\.168\. ]] && [[ ! "$DEST_IP" =~ ^127\. ]]; then
        echo "[ALERT] Suspicious outbound connection: $line"
    fi
done

echo ""
echo "[*] Checking XML parser configuration for XXE hardening..."

# Check Tomcat/JVM for XXE-disabling system properties
if command -v jps &> /dev/null; then
    JAVA_PROCS=$(jps -l | grep -iE '(catalina|tomcat|broadworks|openwave)')
    if [ -n "$JAVA_PROCS" ]; then
        echo "[*] Found Java processes:"
        echo "$JAVA_PROCS"
        # Check if secure processing is enabled
        for PID in $(echo "$JAVA_PROCS" | awk '{print $1}'); do
            if jcmd "$PID" VM.system_properties 2>/dev/null | grep -q "secure-processing"; then
                echo "[OK] PID $PID: XML secure processing property found"
            else
                echo "[WARN] PID $PID: XML secure processing property NOT confirmed"
            fi
        done
    fi
fi

# Check for DOCTYPE-disabling configuration in common locations
echo ""
echo "[*] Checking application XML configurations for XXE protections..."
find /opt /etc/tomcat* /usr/share/tomcat* -name "*.xml" -newer /tmp -mtime -30 2>/dev/null | head -20

echo ""
echo "[*] Checking for recently modified web application files (last 7 days)..."
find /opt/broadworks /opt/openwave /var/www /usr/share/tomcat*/webapps -name "*.jsp" -o -name "*.war" -o -name "*.xml" -mtime -7 2>/dev/null | head -20

echo ""
echo "=============================================="
echo " Check complete. Review any [ALERT] entries."
echo " If alerts found, escalate to IR immediately."
echo "=============================================="