[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHIVtdXH-bkKVh-KrDQ0i63KDAzWrN3TYrFkFOaIZGy8":3},{"article":4,"iocs":56,"watch_terms":64,"solutions":65,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"fd891e79-94c6-42e0-9974-1facef27ea4d","Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities","threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities-8b1499","The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities appeared first on SecurityWeek.","Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder (CVE-2026-111793) and Cisco BroadWorks (CVE-2026-20320). The Openwave flaw allows authenticated users to convert unintended file types and obtain sensitive information, while the Cisco vulnerability enables unauthenticated remote attackers to read sensitive configuration data via blind XML external entity injection. A Chinese-speaking threat actor is reportedly using the Cisco vulnerability in a broad campaign targeting a European telecommunications provider.","Threat actors exploit Openwave and Cisco BroadWorks vulnerabilities to leak sensitive information.","https:\u002F\u002Fwww.securityweek.com\u002Fthreat-actors-exploit-openwave-cisco-broadworks-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F07\u002FCisco-switches-network.jpeg","2026-11-11T09:01:07+00:00","2026-11-11T10:00:26.018038+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"Webtop Media Transcoder","product",{"name":21,"type":22},"Openwave Messaging","vendor",{"name":24,"type":19},"Cisco BroadWorks",{"name":26,"type":22},"Cisco",{"name":28,"type":29},"Malbear Labs","threat_actor",{"name":31,"type":32},"AI intrusion harness","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61],{"type":58,"value":59,"context":60},"cve","CVE-2026-111793","Openwave Webtop Media Transcoder vulnerability",{"type":58,"value":62,"context":63},"CVE-2026-20320","Cisco BroadWorks vulnerability",[26,21,18],{"controls":66,"vendors":149},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,113],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":97,"product_name":110,"url":111,"description":112},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":55,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[150],{"slug":151,"name":26,"logo_path":152,"roles":153},"cisco","\u002Fvendor-logos\u002Fcisco.png",[154],"affected",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":165},"unpatched-openwave-and-cisco-broadworks-flaws-actively-exploited-in-targeted-campaigns","Unpatched Openwave and Cisco BroadWorks Flaws Actively Exploited in Targeted Campaigns","Threat actors, including a Chinese-speaking group targeting European telecoms, are actively exploiting two unpatched vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks. The Cisco flaw is particularly severe because it requires no authentication — a remote attacker can extract sensitive configuration data via blind XML external entity (XXE) injection without any credentials. The Openwave flaw compounds risk by allowing authenticated users to access files and information beyond their intended scope. These vulnerabilities highlight the danger of delayed patching on internet-facing infrastructure, especially in high-value sectors like telecommunications where nation-state actors actively seek strategic intelligence.",[160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A05:2021 Security Misconfiguration","NIS2 Article 21(2)(e)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(e)":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"OWASP A05:2021 Security Misconfiguration":168,"MITRE ATT&CK T1190: Exploit Public-Facing Application":169,"CIS Control 7: Continuous Vulnerability Management (v8)":170},"This NIS2 provision explicitly requires vulnerability handling and disclosure practices in the acquisition and maintenance of systems — telecom operators subject to NIS2 were obligated to have processes that would have detected and remediated these flaws promptly.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; timely remediation of CVE-2026-20320 and CVE-2026-111793 would have directly prevented these active exploitations.","The Cisco BroadWorks blind XXE vulnerability is exploitable in part because XML external entity processing is enabled by default, a classic security misconfiguration that OWASP A05 calls out as a critical category to address.","The unauthenticated exploitation of Cisco BroadWorks via XXE injection directly matches this technique, where adversaries exploit vulnerabilities in internet-facing systems to gain initial access or extract sensitive data.","This control requires organizations to continuously assess and remediate vulnerabilities — had a mature vulnerability management program been in place, these actively exploited CVEs would have been prioritized and patched before attackers could leverage them."]