Severity: High | Priority: 2
Cisco BroadWorks is a calling and unified-communications platform widely used by telecom operators and cloud phone service providers. A high-severity flaw in its Open Client Interface (OCI), tracked as CVE-2026-20320 (CVSS 7.5), lets a remote attacker read files from the BroadWorks server without logging in. OCI is the XML-based interface that provisioning systems, customer portals and integrations use to manage users, groups and services. The flaw is in how BroadWorks processes incoming OCI XML. External entity resolution is enabled by default, so an attacker can send a request containing a crafted document type definition (DOCTYPE). That makes the server load files from its own disk and send their contents out to a server the attacker controls. Because the data leaves through a separate channel, this is known as out-of-band, or blind, XXE.
The flaw affects the BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform on releases before RI.2026.07, whatever their configuration. An attacker can read any file that the BroadWorks service account can access. That may include configuration files, database and system credentials, keys and details of connected services, which could then be used to take over the platform or move deeper into the network. Cisco has not reported any attacks or public exploit code, but the attack is simple, needs no credentials and has no workaround.
Administrators running Cisco BroadWorks should upgrade the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform to release RI.2026.07 or later, since no workaround is available. Until then, restrict access to the OCI-P and OCI-over-SOAP interfaces to known provisioning systems and administrator networks, and make sure they cannot be reached from the internet. Block outbound connections from BroadWorks servers to the internet wherever they aren’t needed, because the attack relies on the server reaching out to the attacker. If an alert has fired, review the server’s outbound connections around that time, and rotate credentials and keys stored in BroadWorks configuration files.