Cisco AnyConnect VPN Client Critical RCE Vulnerability CVE-2020-3556 Patched

Key Takeaways

• Cisco has patched a critical XML External Entity (XXE) injection vulnerability in its BroadWorks platform.
• The flaw, CVE-2026-20320, allows unauthenticated remote attackers to extract sensitive configuration data and files.
• Affected products include the BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform.
• The vulnerability carries a CVSS score of 7.5 (High) and requires immediate patching to BroadWorks RI.2026.07 or later.

Cisco BroadWorks Vulnerability Exposes Sensitive Data to Unauthenticated Attackers

Cisco has issued urgent security updates to address a severe XML External Entity (XXE) injection vulnerability impacting its BroadWorks platform. This critical flaw, identified as CVE-2026-20320, could enable unauthorized remote attackers to gain access to sensitive configuration data and arbitrary files stored on affected systems.

Understanding CVE-2026-20320

The vulnerability, which has a CVSS score of 7.5, stems from an improper restriction of XML external entity reference (CWE-611) within the Open Client Interface XML Parser of the BroadWorks platform. Cisco’s advisory, cisco-sa-bworks-xxe-uwUd7CEt, published on August 19, 2026, explains that the flaw exists because the affected XML parser permits external entity resolution by default. This default behavior allows external entities to direct the parser to retrieve local resources or access other network locations, potentially exposing information that should remain inaccessible via the XML interface.

To exploit this vulnerability, an attacker would send a specially crafted XML message to the Open Client Interface Provisioning (OCI-P) service. Crucially, successful exploitation does not require any form of authentication or user interaction, significantly elevating the risk for any BroadWorks deployments that are exposed or reachable over a network.

Impact and Affected Products

A successful attack leveraging this out-of-band blind XXE injection vulnerability could allow a threat actor to view sensitive files from the filesystem, operating under the permissions of the Cisco BroadWorks user. In a blind XXE scenario, the attacker might not receive the file contents directly in the application’s response but can instead induce the vulnerable server to transmit data or interaction results to an external system controlled by the attacker.

The following Cisco BroadWorks products are confirmed to be affected:

• Cisco BroadWorks Application Delivery Platform
• Cisco BroadWorks Application Server
• Cisco BroadWorks Profile Server
• Cisco BroadWorks Xtended Services Platform

According to Cisco, systems running releases prior to RI.2026.07 across these product families are vulnerable. Cisco has addressed the vulnerability in BroadWorks RI.2026.07. For the BroadWorks Application Delivery Platform, the necessary fix specifically applies to the Open Client Server and OCIOverSoap components.

At the time of the advisory’s publication, Cisco PSIRT stated it had no knowledge of any public disclosures or active malicious exploitation of CVE-2026-20320. The vulnerability was reported by security researcher Sandesh M Gawai.

What You Should Do

• Upgrade Immediately: Organizations utilizing affected BroadWorks releases must upgrade to BroadWorks RI.2026.07 or a later fixed software version as soon as possible. No workaround is available, making an upgrade the only full remediation.
• Limit Network Exposure: Critically, review and restrict network exposure for BroadWorks management and provisioning interfaces, particularly the OCI-P service. It should not be broadly accessible from untrusted networks.
• Implement Segmentation and Firewall Policies: Enhance security by implementing network segmentation, strict firewall policies, and tightly controlled administrative access paths to BroadWorks infrastructure.
• Monitor for Anomalies: Security teams should actively monitor for unusual XML requests, unexpected outbound connections originating from BroadWorks infrastructure, and any suspicious attempts to access local files or internal network services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.