Cisco BroadWorks: an August XXE flaw is now exploited, and attackers are stealing server private keys

What happened

Cisco BroadWorks is the platform many carriers and service providers use to deliver voice services to businesses and households: hosted PBX, voicemail, conferencing and subscriber provisioning. End customers rarely see it – it runs in the provider's data centres.

On 19 August 2026 Cisco published advisory cisco-sa-bworks-xxe-uwUd7CEt for CVE-2026-20320, a flaw in the XML parser of the Open Client Interface (OCI). An unauthenticated attacker can send a crafted XML message and read files on the server. The fix is in release RI.2026.07. At the time, Cisco said it was not aware of any exploitation.

That has changed. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 10 November 2026 and gave US federal agencies until 24 November 2026 to remediate. On the same day, NVD added a reference to a Malbear Labs write-up published on 8 November 2026. It describes a campaign the researchers call "Operation Snowball" against a European telecoms provider and 13 organisations hosted on its infrastructure, with CVE-2026-20320 as the entry point into the provider's network.

How serious is it

A 7.5 looks milder than a straight remote code execution bug. The Malbear Labs case shows why file read on this kind of server matters: the attacker walked away with private keys and credentials and used them to go further into the network.

Technical details

The flaw sits in the XML parser of the Open Client Interface (OCI), which is used to administer BroadWorks and provision subscribers and services. According to Cisco, the parser has external entity resolution enabled by default. An attacker can therefore send the OCI-P (Open Client Interface – Provisioning) service a crafted XML message whose entity points at a file on the server. The parser loads the file and the attacker retrieves it through a side channel rather than the normal response – Cisco calls it an "out-of-band blind XXE". Files are read with the privileges of the BroadWorks user.

On the Application Delivery Platform, Cisco says the affected components are the Open Client Server (OCS) and OCIOverSoap. The vulnerability does not depend on device configuration.

According to Malbear Labs, the attacker targeted an Xtended Services Platform running Release 23.0.1.1075, exposed on port 2208. From that host the researchers say the attacker took the system identity private key, three sets of SSL credentials and three further private keys with matching certificates. They also report that the Provisioning Server, which holds subscriber configuration, had an unauthenticated directory listing; they do not clearly state whether the attacker used it.

The write-up claims that an AI agent – a DeepSeek model with its safeguards suppressed by a long jailbreak system prompt – carried out most of the two-week intrusion, with the operator issuing only brief directives. The researchers say the agent tried dozens of other known flaws (including Citrix NetScaler CVE-2023-4966, PAN-OS CVE-2024-3400 and JBoss/RichFaces CVE-2013-2165) and switched technique whenever a security product blocked it. The material came from an exposed directory on the attacker's infrastructure. We could not verify these findings independently; the facts about the flaw itself come from Cisco and NVD.

As a matter of principle, we don't publish exploitation steps or sample payloads.

Who is affected

According to Cisco, these products are vulnerable in releases earlier than RI.2026.07, regardless of configuration:

• BroadWorks Application Delivery Platform
• BroadWorks Application Server
• BroadWorks Profile Server
• BroadWorks Xtended Services Platform

Carriers, hosted PBX providers and organisations that run BroadWorks themselves need to act. Customers of those providers can't patch it themselves, but a business on a hosted PBX can ask its supplier whether the fix is in place.

How to tell if you were compromised

Cisco has not published indicators of compromise. Malbear Labs lists these defensive indicators for the campaign (defanged, for checking logs, proxy and DNS records):

api.tablacysexplorer[.]com      # C2 domain (Sliver, behind Cloudflare)
146.70.53[.]182:2299            # SSH access to the Sliver server
113.23.212[.]15:8000            # attacker tool staging server
212.46.38[.]73:56777            # operator's secondary machine

Other traces the researchers describe:

• On BroadWorks: unusual inbound XML messages to the OCI-P interface (port 2208) from addresses that don't normally use it, and outbound connections from the BroadWorks server to unknown hosts (typical of blind XXE).
• In web logs: ?c= requests to a PHP webshell, -EncodedCommand payloads sent to IIS servers, RichFaces rf parameter requests, X-PAN-AUTHCHECK: off and X-FMI-PE-ExtendedPrivilege headers, and requests for /getxml?location=/Configuration/ and /sap/public/info.
• On Windows: several PowerShell scripts in C:\Windows\Temp with a process updating a lock file every few seconds; hidden PowerShell processes launched through WMI Win32_Process.Create; services named after Windows Update Orchestrator components.
• On the network: Behinder and suo5 JSP webshells in JBoss or Liferay web roots, chisel on port 8443, and long-lived chunked HTTP connections carrying raw TCP between internal hosts.

You can pull the domains and IP addresses out of a log export with our IOC extractor, which runs entirely in your browser. To score the other flaws in the chain, use our CVSS calculator.

What to do

1. Upgrade all four affected products to RI.2026.07. Cisco says there is no workaround.
2. Restrict access to the OCI-P interface (port 2208 in this campaign) to the systems that actually need it. A management interface should not be reachable from the internet. Our subnet calculator helps with firewall rules.
3. If the server was exposed before you patched, assume data was taken. Rotate private keys and certificates, SSL credentials, database passwords and administrator accounts stored on it (Malbear Labs recommendation).
4. Turn off unauthenticated directory listings, especially on the Provisioning Server.
5. Hunt for the indicators above, and look for lateral movement, not just activity on BroadWorks itself.
6. Check the other flaws used in the campaign. The researchers recommend patching the KEV-listed ones in particular (CVE-2022-22536, CVE-2023-4966, CVE-2024-3400), keeping end-of-life JBoss AS 6 off the internet and restricting outbound connections from servers.
7. Don't rely on signature-based antivirus alone. According to the write-up, the attacker bypassed it with script-only tooling and obfuscated webshell code; behavioural detection helps.
8. Report incidents. Notify your national CERT or CSIRT – the NCSC in the UK, CISA in the US. Organisations in scope of NIS2 in the EU must also meet their national reporting obligations.

Timeline

Updates

• 10 November 2026 – first version of this article.