EUVD Vulnerability Catalog Actively Exploited (KEV)

EUVD-2026-62586

Severity: HIGH Base Score: 7.5 CVSS Version: 3.1

Vulnerability Description

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Scope (S): Unchanged

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): None

▪ Availability Impact (A): None

Affected Vendors & Systems

Vendor Cisco

References & Advisory Links

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

cisco

EPSS Probability

0.39

Known Aliases

GHSA-9w8j-fg77-whw7 CVE-2026-20320

Published On

2026-08-19

Last Updated

2026-08-19

Exploited Since

2026-11-10