[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4b_DPo4B0iLChHcZec5VQU1m-cNmNSA3wrXEvklMb8o":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ef36b4b9-5066-473e-98d4-b4d6e84269ee","CISA flags Cisco BroadWorks flaw as actively exploited in attacks","cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks-22463f","The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [...]","CISA has identified CVE-2026-20320, a high-severity Cisco BroadWorks vulnerability, as actively exploited in attacks. The flaw allows unauthenticated attackers to read sensitive configuration information by sending crafted XML messages. CISA has ordered US federal agencies to patch the vulnerability within two weeks and urged all organizations to prioritize remediation.","CISA flags Cisco BroadWorks vulnerability CVE-2026-20320 as actively exploited.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F28\u002FCISA.jpg","2026-11-11T10:12:08+00:00","2026-11-11T11:00:18.058007+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Cisco BroadWorks","product",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":25},"XML External Entity (XXE)","technology",{"name":27,"type":25},"artificial intelligence",{"name":29,"type":30},"Malbear Labs","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-20320","Cisco BroadWorks vulnerability flagged by CISA as actively exploited.",[21,18],{"controls":61,"vendors":148},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":53,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[149],{"slug":150,"name":21,"logo_path":151,"roles":152},"cisco","\u002Fvendor-logos\u002Fcisco.png",[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":164},"unpatched-cisco-broadworks-flaw-actively-exploited-to-expose-sensitive-config-data","Unpatched Cisco BroadWorks Flaw Actively Exploited to Expose Sensitive Config Data","CVE-2026-20320 in Cisco BroadWorks allows unauthenticated attackers to extract sensitive configuration information simply by sending crafted XML messages — no credentials required. This means any internet-exposed instance of the platform is a viable target, and exploitation requires minimal attacker sophistication. The fact that CISA added this to its Known Exploited Vulnerabilities catalog confirms real-world abuse is already underway, not just theoretical risk. Organizations that delay patching internet-facing communication infrastructure give attackers a window to harvest configuration secrets that can enable further lateral movement or privilege escalation. Timely patch application and disciplined asset visibility are the core defenses here.",[159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.RA-1: Asset Vulnerabilities","NIS2 Article 21(2)(e)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(e)":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"NIST CSF 2.0 ID.RA-1: Asset Vulnerabilities":167,"MITRE ATT&CK T1190: Exploit Public-Facing Application":168,"CIS Control 7: Continuous Vulnerability Management (v8)":169},"NIS2 Article 21(2)(e) specifically covers vulnerability handling and disclosure practices, requiring entities to have processes that ensure timely remediation of flaws like this one in critical communication infrastructure.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined timeframes — directly governing the timely patching of this actively exploited BroadWorks vulnerability.","This category requires organizations to identify and document vulnerabilities in their assets, which would have surfaced CVE-2026-20320 in BroadWorks instances before attackers exploited it.","Attackers are exploiting a publicly accessible BroadWorks XML interface without authentication, which is precisely the technique T1190 describes — initial access through vulnerable internet-facing applications.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying this would have ensured CVE-2026-20320 was identified and patched before active exploitation began."]