The US Cybersecurity and Infrastructure Security Agency (CISA) added on November 10 the CVE-2026-20320 flaw in Cisco BroadWorks to its catalogue of actively exploited vulnerabilities, according to the catalogue itself. The agency set November 24 as the deadline for federal civilian agencies to fix it.
According to CISA's description, the flaw allows a remote, unauthenticated attacker to read sensitive configuration information on the affected system. BroadWorks is the platform telecom carriers and managed service providers use to offer cloud PBX, voice and collaboration services to businesses, according to BleepingComputer, which adds that Cisco patched it in August.
CISA has not given details of who is exploiting the flaw. BleepingComputer notes that the security firm Malbear Labs said over the weekend that an AI agent used it against a European telecom provider; that attribution is Malbear's alone and is not made by CISA.
CISA also urges the private sector to prioritise these patches, according to BleepingComputer. The catalogue states that it is unknown whether the flaw has been used in ransomware campaigns.
This story stands on its own facts. The Post Apocalyptic does not link it to other incidents unless the sources demonstrate a connection.
Sources
Public history
- — Published (selected and written by an AI assistant under our published editorial standards)