Vulnerabilities
Cisco BroadWorks XML Parser Vulnerability (CVE‑2026‑20320) Enables Remote File Disclosure
A flaw in Cisco BroadWorks’ Open Client Interface XML parser lets unauthenticated attackers send crafted messages to the OCI‑P service and retrieve sensitive configuration files. The issue stems from default external entity resolution, enabling a blind XML External Entity (XXE) injection. Cisco has issued patches; no work‑arounds exist. Systems running BroadWorks should apply the update immediately.
A new security advisory from Cisco reveals a high‑impact flaw in the Open Client Interface (OCI) XML parser used by BroadWorks. The vulnerability, identified as CVE‑2026‑20320, allows an unauthenticated, remote attacker to craft an XML payload that exploits the parser’s default external entity resolution. The result is a blind XML External Entity (XXE) injection that can read arbitrary files on the BroadWorks server with the same privileges as the BroadWorks service account.
Attackers would target the OCI‑P (Provisioning) service by sending the malicious XML message over the network. If successful, the attacker could pull sensitive configuration files or other data from the filesystem, potentially exposing critical network settings or credentials.
Cisco has released software updates that fix the parsing logic and disable external entity resolution by default. No interim work‑arounds are available, so applying the patch is the only mitigation. BroadWorks deployments should verify that the latest firmware is installed and monitor for any anomalous OCI traffic.
Organizations using Cisco BroadWorks should act quickly to update their systems and review access controls around the OCI interface to reduce exposure to similar XML‑based attacks in the future.
Related vulnerabilities
Cisco IMC Web Interface XSS Exploit Enables Remote Script Execution – CVE‑2026‑20198
A newly disclosed cross‑site scripting flaw in Cisco’s Integrated Management Controller (IMC) web UI allows an authenticated, remote attacker to inject malicious code into a victim’s browser. By luring a logged‑in user to click a crafted link, the attacker can execute arbitrary scripts or steal browser‑based data. Cisco has released patches; no work‑arounds are available. The vulnerability carries a Medium impact rating and is tracked as CVE‑2026‑20198.
Read briefing
Cisco Finesse Remote File Inclusion Vulnerability (CVE‑2026‑20175) – Unauthenticated Browser Exploit
Cisco Finesse now contains a remote file inclusion flaw that lets attackers inject arbitrary files into a user’s session via crafted HTTP requests. The weakness arises from insufficient input validation, allowing unauthenticated, remote attackers to load malicious scripts into the browser and steal data. Cisco has released patches; no workarounds are available, so affected systems must be updated immediately.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing