External risk intelligence

Cisco BroadWorks OCI XML Parser Information Disclosure Vulnerability.

CVE advisoryKnown Exploit

CVE-2026-20320

The vulnerability affects the Open Client Interface - Provisioning (OCI-P) service in Cisco BroadWorks. This interface acts as an API or management service for provisioning and configuration, which is commonly deployed as a network-accessible service in communication infrastructure deployments. Given its role as a service endpoint, it is frequently exposed to the network to facilitate provisioning operations.

XML External Entity Injection

Cisco Broadworks Application Delivery Platform

before ri.2026.07before 2026.0before 2026.07

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Cisco BroadWorks's Open Client Interface (OCI) XML Parser. This flaw could enable an unauthenticated remote attacker to access sensitive configuration details from an affected system by sending a specially crafted XML message. The potential impact involves an attacker reading system files with the privileges of the Cisco BroadWorks user.

Attackers can read sensitive system files.
This concerns core communication infrastructure.
Confirm if our BroadWorks systems are affected.

Attack Path

How an attacker could exploit the issue

An attacker with network access could send a specially crafted XML message to the Open Client Interface - Provisioning service. This message exploits a weakness in how the system processes XML data, allowing the attacker to read sensitive files from the system with the same permissions as the Cisco BroadWorks user.

Network access is required.
Triggered by sending a crafted XML message.
Allows reading sensitive system files.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated, remote attacker to read sensitive configuration information from an affected Cisco BroadWorks system. This is possible because the system improperly parses XML entries by allowing external entity resolution by default, enabling an attacker to send a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service.

System configuration information.
Via crafted XML message to OCI-P.
Attacker reads sensitive files.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, teams responsible for Cisco BroadWorks, including potentially application owners, infrastructure, platform, and network/security teams, should collaborate on addressing this vulnerability. The initial practical step is to identify all instances of Cisco BroadWorks, determine their network reachability and business criticality, and then locate the accountable owner for each instance to plan remediation efforts based on assessed risk.

Identify affected Cisco BroadWorks systems.
Verify OCI-P service exposure and criticality.
Plan remediation with vendor and risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco BroadWorks and the OCI-P service?

Cisco BroadWorks is a platform used by service providers to deliver voice, video, and messaging services. It functions as the core infrastructure for communication systems. The Open Client Interface - Provisioning (OCI-P) is a management service within BroadWorks that allows administrators and automated systems to configure and manage these communication settings programmatically.

What does CVE-2026-20320 mean for the XML parser?

This vulnerability involves a weakness classified as CWE-611, which relates to the improper restriction of XML external entity references. Because the parser allows external entity resolution by default, it will attempt to process unauthorized, external links found within incoming XML data. In this specific CVE, the system inadvertently treats these external entities as instructions to access and return contents from local files.

How is this Cisco BroadWorks vulnerability triggered?

An attacker triggers this bug by sending a specially crafted XML message to the OCI-P service endpoint. The system processes this message and, due to the misconfiguration, attempts to resolve the embedded external entities. Simply connecting to the service or sending legitimate, non-malicious XML traffic does not trigger the vulnerability; it requires the specific, crafted payload designed to access files.

Who should be concerned about this vulnerability?

Any organization running Cisco BroadWorks should prioritize this, especially if their infrastructure is network-accessible. According to Halo Surface Signal, the OCI-P service is often exposed to the network to support provisioning tasks. If your OCI-P service is reachable via the network, the risk is higher, as an unauthenticated attacker could potentially access sensitive system files.

What are the first steps to respond to CVE-2026-20320?

Begin by creating an inventory of all Cisco BroadWorks deployments in your environment. For each instance, verify whether the OCI-P service is accessible over your network and assess its business criticality. Coordinate with your platform and security teams to locate the system owners and plan remediation based on the official guidance provided by Cisco, while prioritizing these systems based on their specific network exposure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.