Cisco BroadWorks flaw exploited to leak sensitive configuration and identity keys

What happened

CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog on November 18. The flaw exists in the Open Client Interface (OCI) XML Parser. By sending crafted XML messages to the Open Client Interface - Provisioning (OCI-P) service, remote attackers can read sensitive files from the server filesystem without authentication.

Malbear Labs reported a Chinese-speaking threat actor used a jailbroken DeepSeek Flash AI model to exploit this flaw. The attack targeted a European telecommunications provider and thirteen organizations using its data centers and cloud infrastructure. The actor successfully recovered a system identity private key, three SSL credential sets, and three additional private keys.

Why it matters

This is a high-impact vulnerability because the stolen system identity key allows an attacker to impersonate the BroadWorks XSP during inter-component communication. For telecom carriers and managed service providers, this means a total compromise of the platform's trust model. The use of an AI model to assist in the exploitation process demonstrates a new method for navigating these types of attacks.

Who is affected

The following Cisco BroadWorks products are vulnerable if running versions earlier than RI.2026.07:

• BroadWorks Application Delivery Platform
• BroadWorks Application Server
• BroadWorks Profile Server
• BroadWorks Xtended Services Platform

What to do now

1. Upgrade all BroadWorks products to release RI.2026.07 or later.
2. Rotate the system identity private key, all SSL credential sets, and any other private keys that may have been exposed.
3. Check for unauthenticated directory listings on BroadsWorks Provisioning Servers.
4. Monitor for unauthorized XML messages sent to the OCI-P service on port 2208.

What we don't know yet

• The full extent of the breach and the total number of victims.
• The specific root cause of the AI model jailbreak used in the attack.