CISA flags Cisco BroadWorks flaw as actively exploited in attacks

CVE-2026-20320 in Cisco BroadWorks allows unauthenticated attackers to extract sensitive configuration information simply by sending crafted XML messages — no credentials required. This means any internet-exposed instance of the platform is a viable target, and exploitation requires minimal attacker sophistication. The fact that CISA added this to its Known Exploited Vulnerabilities catalog confirms real-world abuse is already underway, not just theoretical risk. Organizations that delay patching internet-facing communication infrastructure give attackers a window to harvest configuration secrets that can enable further lateral movement or privilege escalation. Timely patch application and disciplined asset visibility are the core defenses here.