CVE-2026-20320: Cisco BroadWorks XXE Vulnerability

CVE-2026-20320 Overview

CVE-2026-20320 is an XML External Entity (XXE) vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. An unauthenticated, remote attacker can read sensitive configuration information from an affected system by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. Successful exploitation exposes files on the filesystem with the privileges of the Cisco BroadWorks user. The weakness is classified as [CWE-611] Improper Restriction of XML External Entity Reference.

Critical Impact
An unauthenticated remote attacker can disclose sensitive files from a Cisco BroadWorks server by submitting a crafted XML message to the OCI-P service.

Affected Products

Cisco BroadWorks (Open Client Interface XML Parser)
Cisco BroadWorks Open Client Interface – Provisioning (OCI-P) service
Refer to the Cisco Security Advisory for the authoritative list of affected releases

Discovery Timeline

2026-08-19 - CVE-2026-20320 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-20320

Vulnerability Analysis

The vulnerability resides in how the Open Client Interface (OCI) XML Parser processes incoming XML messages sent to the OCI-P provisioning service. Because external entity resolution is enabled by default, attacker-controlled XML input can reference external entities that the parser dereferences during processing. An attacker submits a crafted XML document containing a malicious DOCTYPE declaration and external entity reference. The parser resolves the entity and inlines the referenced content, which the service returns or reflects back to the attacker.

The result is arbitrary file read within the filesystem accessible to the Cisco BroadWorks user account. Sensitive configuration files, credentials, and internal service data are exposed. No authentication is required and the attack traverses the network.

Root Cause

The root cause is insecure default configuration of the underlying XML parser. External entity resolution and DTD processing are permitted when parsing untrusted client input, meeting the classic definition of an XXE flaw ([CWE-611]). Secure XML parsers must disable DOCTYPE declarations and external entity resolution when handling untrusted data.

Attack Vector

The attack vector is network-based against the OCI-P service. An attacker crafts an XML payload that declares an external entity pointing at a local file path such as a configuration file. The attacker sends the payload to the OCI-P service endpoint. The parser resolves the entity and the file contents are returned in the parser output. No user interaction and no credentials are required.

Refer to the Cisco Security Advisory for authoritative technical detail.

Detection Methods for CVE-2026-20320

Indicators of Compromise

Inbound XML messages to the OCI-P service containing <!DOCTYPE> declarations or <!ENTITY> definitions referencing SYSTEM or PUBLIC identifiers.
OCI-P responses returning contents of local files such as /etc/passwd, BroadWorks configuration files, or credential stores.
Outbound connections from the BroadWorks host to attacker-controlled URIs referenced in external entities (out-of-band XXE).

Detection Strategies

Inspect OCI-P traffic for XML payloads containing DTD subsets, entity declarations, or SYSTEM/file:// URIs.
Correlate BroadWorks application logs with unusual OCI-P request patterns from unauthenticated sources.
Alert on process activity where the BroadWorks user reads files outside its expected working directories following an OCI-P request.

Monitoring Recommendations

Enable verbose logging on the OCI-P service and forward logs to a centralized SIEM for retention and analysis.
Monitor egress from BroadWorks servers for unexpected DNS or HTTP resolution triggered by XML parsing.
Baseline normal OCI-P client behavior and alert on anomalous XML message structures or oversized payloads.

How to Mitigate CVE-2026-20320

Immediate Actions Required

Apply the fixed Cisco BroadWorks software release identified in the Cisco Security Advisory.
Restrict network access to the OCI-P service to trusted management networks and known client hosts only.
Review OCI-P logs for prior XML messages containing external entity declarations.

Patch Information

Cisco has published fixed software for CVE-2026-20320. Administrators should consult the Cisco Security Advisory for the specific fixed release versions applicable to their deployment and follow standard Cisco BroadWorks upgrade procedures.

Workarounds

Cisco has not published a workaround. Restrict OCI-P exposure using network access controls, firewall rules, and segmentation until the patch is applied.
Enforce authentication and IP allowlisting on any upstream reverse proxy or load balancer fronting the OCI-P service.
Disable or block OCI-P interfaces that are not required for provisioning operations in your environment.

bash

# Example: restrict OCI-P access to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 2208 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2208 -j DROP