Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder administrators should review their patch status following a report of active exploitation. The Hacker News reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added vulnerabilities affecting these products to its Known Exploited Vulnerabilities (KEV) catalog. The report also indicates that patches are available.
For organizations running either product, the practical priority is to identify affected deployments, confirm the applicable vendor fixes, and check for signs of compromise. A working service is not evidence that it is secure, and an available patch is not the same as a deployed patch.
What the available report establishes
The November 11, 2026 RSS summary names Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder as the affected products. It identifies CVE-2026-20320, assigns it a CVSS score of 7.5, and begins describing an XML external entity restriction issue.
The full source article was inaccessible during preparation of this advisory. The available excerpt does not provide the second CVE identifier, affected release ranges, fixed versions, or exploitation prerequisites. Those details should be checked against CISA’s catalog and the relevant vendor advisories before making deployment-specific decisions. This article does not infer exploit behavior or recommend a particular software version from the incomplete excerpt.
Immediate actions for administrators
Establish whether the products are present. Check software inventories, service ownership records, and supplier-managed environments. Ask hosting or communications providers whether they operate either product on your behalf and whether your service is affected.
Match installations to authoritative advisories. Consult the CISA KEV catalog and applicable vendor documentation. Confirm product components, installed versions, required fixes, and any dependencies. Do not assume that every release is vulnerable—or that a similarly named product is covered.
Prioritize confirmed affected systems. Reported exploitation should move applicable fixes ahead of routine backlog work. Plan backups, rollback arrangements, and service checks before deployment. If immediate patching is impossible, use vendor-supported mitigations and restrict unnecessary exposure where operationally feasible. Treat temporary restrictions as interim controls, not proof that the vulnerability is resolved.
Verify remediation and investigate suspicious activity
After maintenance, independently confirm the running version or patch state and test essential service functions. Keep evidence of the change rather than relying only on a successful installer message.
Patching and incident investigation serve different purposes. A fix can address a vulnerability without removing an attacker’s earlier access. Preserve relevant logs and review unusual authentication, administrative changes, and service activity using vendor guidance and your incident-response procedures. These are general defensive checks, not confirmed indicators for these particular flaws.
If suspicious evidence emerges, involve the incident-response team and preserve it before disruptive cleanup. The immediate goal is both a verified fix and a defensible assessment of whether further investigation is needed.
Source: The Hacker News — Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches