The Cisco BroadWorks flaw CVE-2026-20320 is being actively exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on 10 November 2026. The bug itself, an XML parsing issue fixed in August, is not the remarkable part. The documented attack behind it is: according to the research group Malbear Labs, a largely autonomous AI agent used the flaw as its way into the network of a European telecommunications provider. Anyone running BroadWorks should upgrade to release RI.2026.07. There is no workaround.
CVE-2026-20320: What Cisco describes
Cisco published the vulnerability on 19 August 2026 in a security advisory and rated it High. The CVSS 3.1 base score is 7.5 and the weakness class is CWE-611 (XML external entity, or XXE). The affected component is the XML parser of the Open Client Interface (OCI), which resolves external entities by default. An unauthenticated attacker can therefore send a crafted XML message to the OCI-P (Open Client Interface – Provisioning) service and read files from the filesystem with the privileges of the BroadWorks user.
XXE is an old and well understood class of bug. An XML document references an “external entity”, such as a local file, and the parser obediently loads its contents. Cisco calls this an “out-of-band blind” variant, meaning the data does not necessarily come back in the direct response but can leak through a second channel. That is hardly an obstacle for an attacker.
According to the advisory, the following products are affected regardless of configuration:
- BroadWorks Application Delivery Platform (Open Client Server and OCIOverSoap)
- BroadWorks Application Server
- BroadWorks Profile Server
- BroadWorks Xtended Services Platform (XSP)
For all four, releases earlier than RI.2026.07 are vulnerable and RI.2026.07 is the first fixed release. Cisco explicitly lists no workarounds. The advisory credits security researcher Sandesh M Gawai with reporting the bug. At the time of the advisory (version 1.0), Cisco was not aware of any malicious use. The KEV listing has changed that.
CISA deadline and context
CISA lists CVE-2026-20320 in its alert of 10 November alongside five other flaws, including the Chrome bug CVE-2026-125350 and two Barracuda issues. US federal civilian agencies must patch by 24 November 2026. CISA does not say who is behind the attacks, and it does not confirm Malbear Labs’ analysis. It only states that there is evidence of exploitation.
BroadWorks is not software that end customers install themselves. Carriers and managed service providers use it to run hosted PBX, voice and collaboration services for business customers. The ones who need to act are therefore carriers and service providers. Companies using a cloud phone system may still want to ask their provider whether the platform is based on BroadWorks and whether it has been updated. Another telephony product, FreeSWITCH with CVE-2026-116779, landed on the KEV list just days earlier.
Operation Snowball: an AI agent as the attacker
The context comes from a Malbear Labs report published on 8 November. During a routine sweep for open directories, the researchers found an attacker’s entire workspace, downloadable without authentication: more than 70 compressed session transcripts, reconnaissance output on hundreds of targets, tooling, credential caches and the agents’ own reports. Malbear calls the campaign “Operation Snowball”. The researchers say they are not publishing the directory’s IP address to protect the affected organisations.
According to the report, the intrusion ran for more than two weeks against an unnamed European telecommunications provider and organisations that host their systems in its data centres and cloud. The agent’s own attribution work named 13 of those organisations as in scope. The operator behind it was Chinese-speaking.
How the agent got in
Malbear says the primary target was a BroadWorks Xtended Services Platform running release 23.0.1.1075 on port 2208. The agent sent a crafted OCI request and read files from the server without logging in. It recovered the system identity private key, three SSL credential sets and three additional private keys. BroadWorks components use the identity key to authenticate to each other, so whoever holds it can impersonate the XSP in internal communication. The report adds that the BroadWorks Provisioning Server was separately exposed through an unauthenticated directory listing.
The agent later used further, partly very old flaws: a Liferay vulnerability (CVE-2020-7961) and a JBoss RichFaces bug from 2013 (CVE-2013-2165) for a second foothold. Among the tools, Malbear lists the Sliver C2 framework, the Chisel tunnel and the Behinder web shell.
A jailbreak and very little human steering
Technically, the operation used a custom-built agent framework around the DeepSeek Flash model with a context window of one million tokens. A primary agent keeps the full operational picture in context and hands subtasks to worker agents. According to Malbear, the model’s safety behaviour was removed with a publicly available jailbreak template that the operator extended. The report puts the resulting system prompt at around 78,000 characters, and it declares any refusal a “malfunction”. Across more than 70 sessions, Malbear found not a single recorded refusal.
The human’s role stands out. The report says the operator’s messages were mostly two words or a short phrase, such as “Go on”, “Stop” or an instruction to close the latest high-risk loophole. The longest message was a list of three internal IP addresses to leave alone. The operator did not need to know how to exploit anything. Malbear sums it up this way: the attacker delegated the intrusion to an AI and checked in asynchronously to review progress.
Adapting to defences
The report describes several moments when security software stopped the agent. When an endpoint product killed a PwnKit exploit (CVE-2021-4034), the agent switched to a different privilege escalation path without being told to. When a tunnelling tool was blocked, it had a worker agent write a replacement. According to Malbear, the haul included dozens of credential sets, thousands of rows of the provider’s subscriber billing and device records, and access to a database holding millions of patient records that was still protected by default credentials. These figures come from the attacker’s own records and have not been independently confirmed.
The pattern is not entirely new. AI agents also played a central role in VAPOR PANDA and in the case of a hacker who breached more than 100 companies with Claude Code and DeepSeek. Operation Snowball, however, shows particularly clearly how little expertise the human side needs once known flaws stay open.
What operators should do now
- Patch: Bring all affected BroadWorks components to RI.2026.07 or later. The fix has been available since August.
- Check exposure: OCI-P and provisioning interfaces should not be reachable from the internet. Turn off unauthenticated directory listings.
- Assume compromise: Anyone who was vulnerable and reachable until recently should review logs for unusual OCI requests and rotate the platform’s private keys and certificates. This is a general recommendation, not guidance from Cisco.
- Close old holes: Malbear advises patching the KEV-listed flaws from the agent’s arsenal immediately and treating internet-facing end-of-life systems such as JBoss AS 6 as already compromised.
- Watch internally: Malbear notes that an agent is noisier than a human because it scans continuously and in parallel. That only helps if traffic between internal hosts is monitored, not just the perimeter.
Bottom line
On its own, CVE-2026-20320 is a solid but unspectacular bug: CVSS 7.5, file read access, fixed since August. What makes it dangerous is what follows, because stolen keys open further doors. Operation Snowball shows that autonomous attack tooling works through exactly these leftover patches in a systematic way. The lesson is unglamorous but urgent: close known flaws in exposed systems quickly, before an agent moves them to the top of its list.
