Threat actors are actively exploiting software vulnerabilities in communications infrastructure software from Openwave Messaging and Cisco Systems to access sensitive records. The observed activity involves an authentication bypass mechanism in Openwave's document conversion component and an unauthenticated data exposure flaw in telecommunications routing systems developed by Cisco.

According to SecurityWeek, the ongoing campaigns led the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to place both weaknesses onto its Known Exploited Vulnerabilities (KEV) catalog on November 10. The agency directed federal civil agencies to remediate the flaws by November 24.

Attacks on Telecommunications Providers

The Cisco weakness, registered as CVE-2026-20320, has already surfaced in intrusions aimed at service providers. On November 8, security firm Malbear Labs reported that a Chinese-speaking threat group exploited the flaw as part of a campaign utilizing an autonomous artificial intelligence intrusion harness against an unnamed European telecommunications provider and its clients.

Investigators determined that the threat group targeted at least 13 organizations relying on the European provider's platform. The campaign centered heavily on network asset enumeration, credential theft, and harvesting sensitive subscriber billing and device records. Cisco originally disclosed the vulnerability on August 19.

Meanwhile, Japan's JVN warned on November 9 that attackers were actively exploiting a flaw in Openwave Webtop Media Transcoder, indexed as CVE-2026-111793. Japan JVN alerted administrators that authenticated adversaries could leverage the flaw to upload specially crafted files and obtain confidential operational details.

Technical Mechanics of the Vulnerabilities

Cisco BroadWorks functions as an enterprise call control and communication services architecture widely deployed by service providers. CVE-2026-20320 represents an out-of-band blind XML external entity (XXE) injection flaw residing within the platform's Open Client Interface – Provisioning (OCI-P) service.

The security issue arises because the application improperly parses XML entries, allowing external entity resolution by default. Cisco explained in its advisory that a remote attacker can exploit this condition without authentication by transmitting a crafted XML payload directly to the OCI-P interface, allowing unauthorized access to sensitive internal configuration data.

The Openwave vulnerability affects Webtop Media Transcoder, a utility integrated into the vendor's webmail suites to convert attached documents. Openwave Messaging provides these email environments to communication service providers. CVE-2026-111793 occurs because the transcoder fails to enforce administrator-defined file-type limits.

Openwave stated in its advisory that an authenticated user can process and convert unintended document formats if they bypass standard webmail controls. Exploiting this lack of restriction allows adversaries to harvest restricted system information by feeding manipulated files to the underlying transcoder.

Vendor Fixes and Government Directives

Patches for the Cisco flaw were delivered in BroadWorks version RI.2026.07. The update covers several components, including the Application Delivery Platform, Application Server, Profile Server, and the Xtended Services Platform.

For Openwave Messaging, resolved code was made available in Webtop Media Transcoder version 1.1.22.0. While that build was initially rolled out in December 2021, public documentation and vulnerability disclosures appeared much later, with Openwave issuing a security disclosure on October 7 followed by the formal CVE record publication on October 16.

Beyond the Openwave and Cisco issues, CISA's November 10 catalog update also incorporated two Barracuda defects, an exploited Outlook zero-day addressed recently, and a zero-day flaw in Google Chrome that received emergency fixes on November 9.

What You Should Do

Telecommunications operators and enterprise IT teams running affected environments should act immediately to isolate vulnerable interfaces and deploy vendor updates:

  • Update Cisco BroadWorks: Upgrade installations across Application Delivery Platforms, Application Servers, Profile Servers, and Xtended Services Platforms to build RI.2026.07 or later.
  • Restrict OCI-P Exposure: Ensure that Cisco BroadWorks Open Client Interface – Provisioning services are isolated from public internet exposure and accessible only to trusted administration segments.
  • Patch Openwave Transcoders: Verify that Webtop Media Transcoder deployments run version 1.1.22.0 or subsequent releases enforcing administrative file limits.
  • Audit Network and Billing Logs: Review telecommunications management systems for unusual XML transactions, unexpected document parsing requests, and unauthorized access to subscriber profiles and billing databases.