HighVulnerabilityNov 10, 2026

CISA adds Cisco BroadWorks XXE to KEV

CISA added CVE-2026-20320, an XML External Entity injection vulnerability in Cisco BroadWorks, to the KEV catalog. The unauthenticated flaw allows remote attackers to read sensitive configuration information from affected systems. Federal agencies must patch by November 24, 2026 per BOD 26-04 guidance.

Vulnerabilities

CVE-2026-20320 CVSS 7.5 EPSS 0.4% Exploited (CISA KEV)

Sources

CISA KEVRead the original article
The Hacker NewsRead the original article
BleepingComputerRead the original article

AI-written summary. Check the original reporting before acting.