Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.
⚡ Why it matters
An AI attack agent used the BroadWorks bug to breach a European telecom and steal subscriber records, showing how AI tooling turns old unpatched flaws into easy targets.
The two flaws
CVE-2026-20320(CVSS 7.5): an XML external entity (XXE) flaw in the OCI XML parser of Cisco BroadWorks that lets an unauthenticated attacker read sensitive configuration. Fixed in August 2026.CVE-2026-111793(CVSS 4.3): a flaw in Openwave Messaging Webtop Media Transcoder that lets an authenticated user process unintended document types and upload a crafted file to obtain sensitive data. Fixed in October 2026. Japan's JVN said the developer has observed attacks.
Operation Snowball
According to Malbear Labs, the BroadWorks bug was used in Operation Snowball, where an unknown Chinese-speaking actor ran an autonomous attack framework built on a jailbroken DeepSeek Flash model against a European telecom and 13 companies it hosts. Over two weeks, the attackers mapped hundreds of assets, extracted dozens of credential sets and exfiltrated thousands of billing and device records.
The agent exploits a long list of known older flaws, including bugs in Citrix NetScaler, PAN-OS GlobalProtect, SAP NetWeaver and Qlik Sense.
What to do
- If you run Cisco BroadWorks or Openwave, apply the August and October fixes now.
- Audit internet-facing systems for old unpatched flaws, since AI agents try them all quickly.
- Use CISA's KEV catalog to prioritize patching.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
OpenSSH Flaw Exploited on Alpine: CISA Adds 4 KEV Bugs
On November 9, CISA added four actively exploited flaws to its KEV catalog. The standout is an OpenSSH bug on Linux systems using musl libc without PAM, such as Alpine Linux, where some setups accept any long password.