CISA announced on 10 November that it had added vulnerabilities in Cisco BroadWorks and Openwave Webtop Media Transcoder to its catalog, citing evidence that attackers are exploiting both.
CISA added Cisco BroadWorks CVE-2026-20320 and Openwave Webtop Media Transcoder CVE-2026-111793 to its Known Exploited Vulnerabilities catalog, saying it had evidence of active exploitation. The US agency’s November 10 announcement puts both flaws on a list it uses to guide organizations' repair priorities.
CISA classifies the BroadWorks flaw as an improper restriction of XML external entity references. XML is a format for structured data; an external entity can refer to content outside an XML document. In this type of attack, inadequately configured software can process such a reference and potentially expose confidential information. That general risk does not establish the impact of this particular flaw.
CISA describes the Openwave flaw as an incorrect transfer of resources between spheres; JVN identifies it as CWE-669. A November 9 notice from JVN says an authenticated attacker who uploads a specially crafted file through specific steps may be able to obtain sensitive information. The notice says Openwave had observed attacks exploiting the flaw.
JVN identifies Webtop Media Transcoder versions before 1.1.22.0 as affected and advises users to apply the developer’s patch and contact the developer for details. CISA’s announcement does not specify affected BroadWorks versions or a fix.
Under CISA’s directive BOD 26-04, US federal civilian executive branch agencies must prioritize rapid fixes for catalog-listed flaws on publicly exposed systems when exploitation gives an attacker total control of the system. The directive defers action on lower-risk vulnerabilities and sets expectations for when agencies must check whether a system was compromised before patching.
CISA encourages other organizations to manage vulnerabilities based on risk and prioritize fixing those in the catalog. Its announcement does not give a remediation deadline for either flaw.
The agency describes the Microsoft Outlook vulnerability as a missing user interaction for a potentially unsafe action. Microsoft patched the flaw after attackers exploited it to steal account authentication data.
1 min
The Japanese retailer says it blocked unauthorized access on 6 November and will contact affected customers by email or post.
2 min
Governor Kathy Hochul launched the center at Binghamton University as the state opened a registration portal for large developers. Both prepare for RAISE Act requirements beginning 1 January 2027.
3 min
