A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML…
| Vendor | Product | Versions |
|---|---|---|
| cisco | broadworks_application_delivery_platform | < ri.2026.07 |
| cisco | broadworks_application_server | < 2026.0 |
| cisco | broadworks_profile_server | < 2026.07 |
| cisco | broadworks_xtended_services_platform | < 2026.07 |
Yes — actively exploited. Added to the CISA KEV catalog on 2026-11-10. Ransomware use: Unknown.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.