CISA Flags Actively‑Exploited Cisco BroadWorks XXE Flaw (CVE‑2026‑20320)

Qué ocurrió

CISA listed Cisco BroadWorks CVE‑2026‑20320 as actively exploited; attackers used a crafted XML payload to read private keys from the OCI parser, leveraging a jail‑broken AI model to automate attacks against a European telecom provider and its customers.

Por qué es importante para la confianza y el cumplimiento

• The incident tests the effectiveness of vulnerability‑management and patch‑prioritization controls, a single control area that satisfies multiple framework requirements.
• Demonstrates need for continuous monitoring of KEV entries and rapid remediation evidence collection.
• Supports mapping of patch‑management controls to audit frameworks such as NIST CSF 2.0.

Who is affected

Recommended actions

1. Apply Cisco’s August 2026 patch for CVE‑2026‑20320 immediately.
2. Scan for unauthenticated directory listings on OCI‑P port 2208.
3. Update vulnerability‑management policies to treat KEV items as critical with a ≤ 14‑day remediation deadline.
4. Collect and retain patch‑deployment logs as audit evidence.