CISA adds Cisco BroadWorks and Openwave flaws to KEV list after reports of active exploitation

Key Points

CISA warns of active exploitation of vulnerabilities involving Cisco BroadWorks.
CISA adds two related flaws to its Known Exploited Vulnerabilities (KEV) catalog.
SecurityWeek and The Hacker News identify CVE-2026-111793 and CVE-2026-20320 as part of the exploited set.
The vulnerabilities are associated with disclosure of sensitive information, including configuration data.
One cited technical detail is that CVE-2026-20320 involves improper restriction of XML external entity.

Where coverage differs

Across the three summaries, outlets broadly agree that CISA is flagging actively exploited vulnerabilities tied to Cisco BroadWorks and Openwave, and that specific CVEs are involved. Differences include emphasis: Bleeping Computer foregrounds CISA’s active-exploitation warning; SecurityWeek highlights both products together and the data types (notably configuration information). The Hacker News adds more technical framing by mentioning the KEV catalog update, including a CVSS score (7.5) and a more specific description for CVE-2026-20320. The summaries also vary on how much detail is provided beyond the fact of exploitation and the affected components.

See what each outlet emphasised ↓

The US Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are actively exploiting vulnerabilities affecting Cisco BroadWorks. CISA issues the alert as part of its Known Exploited Vulnerabilities (KEV) program, signaling that the flaws are being used in real attacks.

Multiple outlets link the activity to specific vulnerabilities and describe their potential impact. SecurityWeek and The Hacker News both cite two CVEs associated with Cisco BroadWorks and Openwave, and they report that attackers can obtain sensitive information, including configuration data. The Hacker News also notes CISA’s KEV catalog update, indicating evidence of ongoing exploitation.

Coverage differs mainly in emphasis and the amount of technical detail. Some outlets foreground CISA’s flag as the key development, while others focus more on the affected products and the types of information reportedly targeted. SecurityWeek additionally frames the story as part of a broader exploitation of both Openwave and Cisco BroadWorks issues.

This summary is generated automatically from the reporting of the outlets listed on this page. Follow their links for the full coverage.

How Outlets Covered This Story

BLE

Bleeping Computer

Independent

CISA flags Cisco BroadWorks flaw as actively exploited in attacks

Bleeping Computer leads with CISA’s warning that the Cisco BroadWorks flaw is actively exploited, framing the story around the US agency’s alert.

6 hours ago

SEC

SecurityWeek

Independent

Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities

SecurityWeek emphasizes threat actors exploiting both Openwave and Cisco BroadWorks issues, highlighting specific CVEs and the possibility of leaking configuration data.

7 hours ago

THE

The Hacker News

Independent

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The Hacker News focuses on CISA adding the Cisco BroadWorks and Openwave flaws to the KEV catalog, stressing that patches are available while exploitation continues, and includes a CVSS score and vulnerability type.

10 hours ago

We use cookies

This website uses cookies in order to enhance the overall user experience.

Take a look at our Cookies Policy for more information.

CISA adds Cisco BroadWorks and Openwave flaws to KEV list after reports of active exploitation

Where coverage differs

dbrand launches $35 Pulse Band for Fitbit Air as first third-party strap on Google Store

Katsuhiro Harada criticizes Xbox Series S development constraints at developer event

Check Point links three China-nexus hacking campaigns via Sparrow malware framework