CISA Adds Openwave and Cisco BroadWorks Flaws to KEV as Exploitation Is Reported

CISA put two information-disclosure bugs on its Known Exploited Vulnerabilities catalog on November 10: one in Openwave Webtop Media Transcoder, one in Cisco BroadWorks. Federal agencies have until November 24 to apply vendor mitigations. Both products already have fixed versions, which is the part worth noticing.

What happened

The Openwave flaw is tracked as CVE-2026-111793. Openwave Messaging sells email and messaging platforms, webmail included, to communication service providers, and Webtop Media Transcoder is the piece that converts documents. The bug is that administrator-defined file-type restrictions aren't enforced, so a user can get unintended document types processed and converted by going around the webmail front end. Openwave's advisory says as much, and the CNA description matches it.

Version 1.1.22.0 of the transcoder, which shipped in December 2021, contains the patches. The defect was disclosed on October 7 and the CVE record went out on October 16. Japan's JVN flagged it as exploited on November 9, describing an authenticated attacker uploading a crafted file to pull sensitive information.

The Cisco bug is CVE-2026-20320, an XML external entity injection in the Open Client Interface XML Parser of BroadWorks. External entity resolution is allowed by default, so a crafted XML message to the OCI Provisioning service can make the parser read files off the system with the privileges of the BroadWorks user. No authentication needed, remote. Cisco disclosed it on August 19. Patches landed in version RI.2026.07 of BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform.

On November 8, Malbear Labs said a Chinese-speaking threat actor had been exploiting the BroadWorks bug in a campaign against a European telecommunications provider and its customers, using what the firm described as an autonomous AI intrusion harness. The reported focus was asset enumeration, credential theft, and harvesting subscriber billing and device records.

Why these two matter

Neither bug gives an attacker a shell. That's the honest framing. An XXE in a provisioning interface reads files; a file-type restriction bypass in a transcoder gets documents converted that shouldn't be. What makes them worth a KEV entry is what sits behind the boundary. BroadWorks is call-routing and subscriber infrastructure for carriers, and its configuration files are the kind of thing that tells you how the whole deployment is wired. A transcoder that will happily process file types an administrator blocked is a way to feed a parser something it wasn't meant to see, and the JVN note says the outcome was sensitive information in the attacker's hands.

The Openwave case also has a timing problem. The fix is from December 2021. Anyone still running an older transcoder has had years to move and hasn't, and the exploitation flag arrived in November.

HackZoneLabs assessment

In our view the BroadWorks item deserves attention first, and not because of the CVSS gap. It's unauthenticated, it's remote, and the reported campaign against a European carrier suggests someone is already using it against real subscriber data. The Openwave bug needs a login, which narrows who can reach it, but the affected population is carriers running old transcoder builds, and those are exactly the organisations that tend to sit on a 2021 patch.

We'd also treat the Malbear Labs campaign description with some care. The claim about an autonomous AI intrusion harness comes from one firm, the article gives no technical detail on how it worked, and the figure of at least 13 organisations is hedged as "may have been targeted." That's a claim, not a finding. The KEV listing itself is a separate and firmer signal: CISA doesn't add entries on a vendor's say-so alone.

What's still unknown

Nobody has published a write-up of the Openwave exploitation, so how the file-type bypass was actually used to reach sensitive data isn't public. The KEV entry lists ransomware use as unknown for both. Cisco's affected-version data in the record is marked N/A, so the record doesn't tell you which BroadWorks releases are vulnerable beyond the fixed version. And the Malbear Labs campaign has no independent confirmation in what we have.

What to check first

If you run BroadWorks, confirm whether the OCI-P service is reachable from outside your network, and get to RI.2026.07 on all four components. If you run Openwave, check the transcoder build against 1.1.22.0 and look at whether file-type restrictions are actually being enforced on the conversion path rather than only in the webmail UI. For both, the KEV due date is November 24, and the required action is vendor mitigations plus the forensics triage guidance CISA attached to the directive.

CVE references

CVE-2026-111793

CVE-2026-20320