Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities

Threat actors are actively exploiting two separate vulnerabilities — one in Openwave Webtop Media Transcoder and one in Cisco BroadWorks — to access sensitive information held by telecommunications providers and their enterprise customers. CISA added both flaws to its Known Exploited Vulnerabilities catalog on November 10, giving federal agencies a two-week deadline to apply patches. SecurityWeek's report covers the technical details of each flaw, the confirmed targeting, and the agency guidance now in force.

This article explains what each vulnerability does, who is exposed, what patches are available, and what a Chinese-speaking threat actor has already done with the Cisco BroadWorks flaw — including details of an AI-assisted intrusion campaign against a European telecom and at least thirteen of its customers.

01File-type bypass in Openwave Webtop Media Transcoder

Openwave Messaging provides email and messaging platforms, including webmail, to communication service providers. Its Webtop Media Transcoder component handles document conversion, and the flaw tracked as CVE-2026-111793 exists because administrator-defined file-type restrictions are not enforced. This allows users to convert file types that should be blocked.

"This may allow an authenticated user to process and convert unintended document types if bypassing the webmail experience," Openwave Messaging stated in its advisory. The weakness requires an authenticated session, so an outsider cannot trigger it cold, but a logged-in user — or an attacker who has obtained valid credentials — can upload a specially crafted file to reach sensitive information.

Openwave released version 1.1.22.0 of Webtop Media Transcoder in December 2021, and that build contains the patch. The CVE was disclosed on October 7, a formal CVE record was published on October 16, and Japan's JVN vulnerability coordination body flagged active exploitation on November 9.

02Blind XML injection in Cisco BroadWorks OCI-P service

The Cisco BroadWorks flaw, CVE-2026-20320, is an out-of-band blind XML external entity (XXE) injection vulnerability disclosed on August 19. It can be exploited remotely and without authentication to read sensitive configuration information from affected BroadWorks deployments.

"This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default," Cisco noted in its advisory. "An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service." No prior access to the system is required, making the attack surface substantially broader than the Openwave bug.

Cisco patched the issue in version RI.2026.07 of BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. Organizations running any of those four components on earlier builds remain exposed.

03Chinese-speaking actor and the AI intrusion harness

On November 8, Malbear Labs warned that a Chinese-speaking threat actor had been actively exploiting CVE-2026-20320 in a broad campaign. The actor used an autonomous AI intrusion harness — a tool that automates reconnaissance and exploitation steps — to target a European telecommunications provider and its customers.

At least thirteen organizations using that telecom provider's services may have been targeted. The campaign concentrated on asset enumeration, credential theft, and the harvesting of subscriber billing and device records. The use of an autonomous AI tool marks an escalation in operational tempo compared with manually directed intrusions.

The November 8 disclosure came one day before CISA acted, suggesting that intelligence about active exploitation was already circulating in the security research community before the federal agency made its formal catalog addition.

04CISA KEV deadline and the broader catalog additions

CISA added CVE-2026-111793 and CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on November 10. Federal agencies are required to patch both vulnerabilities by November 24, leaving a fourteen-day remediation window from the date of the KEV listing.

CISA simultaneously expanded the same KEV update to include two Barracuda flaws, an Outlook zero-day that Microsoft patched on November 11 as part of a 1,094-flaw Patch Tuesday release, and a Chrome bug patched on November 9 as a zero-day. The breadth of the single-day addition signals that CISA is tracking several concurrent exploitation waves across different product families.

For organizations outside the federal civilian executive branch, the KEV catalog still represents the most authoritative public list of flaws with confirmed in-the-wild exploitation, and the November 24 deadline serves as a practical benchmark for private-sector patch prioritization.

05Patch status and what remains unconfirmed

Patches exist for both CVEs. Openwave's fix shipped in December 2021 — nearly five years before active exploitation was confirmed — meaning any organization still running a version older than 1.1.22.0 has had a prolonged window of exposure. Cisco's patch arrived in BroadWorks RI.2026.07, released alongside the August 19 disclosure.

What is not yet public is the full scale of the BroadWorks campaign. Malbear Labs identified at least thirteen affected organizations through the European telecom, but the AI-assisted harness operated autonomously, and the total number of targets across other providers has not been reported. The identity of the Chinese-speaking threat actor has also not been formally attributed to a named group.

Whether the Openwave CVE was exploited by the same actor or by an unrelated party also remains undisclosed. Japan JVN confirmed exploitation on November 9 but did not publish attacker attribution or describe the method used to obtain the authenticated session needed to trigger the file-type bypass.