CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, including CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging’s Webtop Media Transcoder. The agency set November 24 as the remediation deadline for these two entries for federal civilian agencies under its latest KEV update. The same batch also included Outlook’s exploited NTLM-hash flaw, Chrome’s XML use-after-free and Barracuda’s chained ESG vulnerabilities.
CVE-2026-20320 affects the XML parser in Cisco BroadWorks’ Open Client Interface. Cisco says an unauthenticated remote attacker can send a crafted XML message to the OCI-P service and read sensitive files from the system with the privileges of the BroadWorks user. The company fixed the issue in BroadWorks release RI.2026.07. Its August 19 advisory said Cisco’s security response team was not aware of malicious use at the time.
The second flaw, CVE-2026-111793, affects Openwave Webtop Media Transcoder. Openwave assigns it a CVSS score of 4.3, while JPCERT/CC’s November 9 advisory labels it Critical and says a specially crafted upload could expose sensitive information. The flaw allows an authenticated user to bypass administrator-defined file-type restrictions by reaching the transcoder outside the Webmail experience. Openwave’s security advisory says versions before 1.1.22.0 are affected and recommends upgrading to the latest supported Media Server 2.0 release. Version 1.1.22.0, which fixes the issue, was released in December 2021.
JPCERT/CC said the developer had observed attacks exploiting the Openwave flaw, while CISA’s latest catalog lists both vulnerabilities as exploited. Neither CISA nor the vendors have published details about the attack campaigns or identified a threat actor. Cisco’s August advisory predates the later exploitation confirmation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
