{"metadata": {"vulnerability": "CVE-2026-20320", "count": 51, "kinds": {"milestone": 7, "sighting": 22, "kev": 6, "other": 16}, "linked_omitted": 0}, "data": [{"timestamp": "2025-10-08T11:59:15.411Z", "date_only": false, "value": "2025-10-08T11:59:15.411Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-20320", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-19T00:00:00Z", "date_only": true, "value": "2026-08-19", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1058", "record": "CERTFR-2026-AVI-1058", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-08-19T15:56:09Z", "date_only": false, "value": "2026-08-19T15:56:09+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-19T15:56:30Z", "date_only": false, "value": "2026-08-19T15:56:30+00:00", "kind": "other", "label": "Document generated", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "other", "label": "Updated", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-08-19T16:39:04.920Z", "date_only": false, "value": "2026-08-19T16:39:04.920Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-20320", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-19T16:39:04.920Z", "date_only": false, "value": "2026-08-19T16:39:04.920Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisco", "record": "CVE-2026-20320", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-19T17:18:40Z", "date_only": false, "value": "2026-08-19T17:18:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9W8J-FG77-WHW7", "record": "GHSA-9W8J-FG77-WHW7", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-08-19T17:18:40.433Z", "date_only": false, "value": "2026-08-19T17:18:40.433", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20320", "record": "FKIE_CVE-2026-20320", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-19T18:32:50Z", "date_only": false, "value": "2026-08-19T18:32:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9W8J-FG77-WHW7", "record": "GHSA-9W8J-FG77-WHW7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1058", "record": "CERTFR-2026-AVI-1058", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1058", "record": "CERTFR-2026-AVI-1058", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1058", "record": "CERTFR-2026-AVI-1058", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-08-20T02:25:18.059Z", "date_only": false, "value": "2026-08-20T02:25:18.059754Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mti6xkiyyv2u", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "0d99f0d3-9a38-44c7-89b0-766fd0450856", "content": "Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.\n\n#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mti6xkiyyv2u"}, {"timestamp": "2026-08-20T12:21:41.482Z", "date_only": false, "value": "2026-08-20T12:21:41.482938Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mtjabxdkxh2l", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "74d2b131-9b33-4e06-a5f9-76cd5f051b6b", "content": "New Cisco BroadWorks XXE flaw (CVE-2026-20320) lets attackers read config files\u2014patch RI.2026.07 now to stay safe. #Cisco #BroadWorks #XXE #Cybersecurity #CVE2026 #Infosec https://thedailytechfeed.com/critical-xxe-flaw-in-cisco-broadworks-lets-attackers-expose-configuration-files/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mtjabxdkxh2l"}, {"timestamp": "2026-08-20T12:31:25.287Z", "date_only": false, "value": "2026-08-20T12:31:25.287548Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mtjateubts2v", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "f9b3db87-94f3-4f51-85b3-fa92b2a4334e", "content": "Onderzoekers ontdekken ernstige XML-kwetsbaarheid in Cisco BroadWorks die toegan\n\nEen ernstige kwetsbaarheid, met een CVSS-score van 7.5 en aangeduid als CVE-2026-20320, is ontdekt in het Cisco BroadWorks-platform. Deze kwetsbaarheid, een XML External Entity (XXE) injection (CWE-611), bevind...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mtjateubts2v"}, {"timestamp": "2026-08-20T14:25:17.683Z", "date_only": false, "value": "2026-08-20T14:25:17.683654Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mtjh6z3l4k26", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "b71f0075-cb8d-4ed1-8573-0d1edf43e84a", "content": "\ud83d\udd17 CVE : CVE-2026-20030, CVE-2026-20231, CVE-2026-20315, CVE-2026-20317, CVE-2026-20318, CVE-2026-20319, CVE-2026-20320, CVE-2026-20357, CVE-2026-20358, CVE-2026-20359", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mtjh6z3l4k26"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-20320", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "evidence.0.details.date_added", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-20320", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20320", "record": "FKIE_CVE-2026-20320", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "status.status_updated_at", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-20320", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2026-20320 added to CISA KEV"}, {"timestamp": "2026-11-10T20:00:01Z", "date_only": false, "value": "2026-11-10T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-10T20:00:02.370Z", "date_only": false, "value": "2026-11-10T20:00:02.370668Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/86dfc03f-6300-47fb-b649-7ee0e3001876", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "34d36456-f466-4cf0-aa4c-3aae289a3dc3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/86dfc03f-6300-47fb-b649-7ee0e3001876", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-10T20:34:17.485Z", "date_only": false, "value": "2026-11-10T20:34:17.485954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n236pdn76wtj", "record": "cve-2026-20320", "field": "creation_timestamp", "uuid": "610408db-8fac-4f13-ac63-1706ab7d10f9", "content": "CVE-2026-20320: Cisco BroadWorks Improper Restriction Of XML External Entity Reference Vulnerability\nhttps://cyber.eventmonitor.net/incident/EM-20261110-1E0F/cve-2026-20320-cisco-broadworks-improper-restriction-of-xml-external-entity/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n236pdn76wtj"}, {"timestamp": "2026-11-10T21:15:10.803Z", "date_only": false, "value": "2026-11-10T21:15:10.803810Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mzyedh4npu2o", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "cd43be18-3c43-4eea-a37b-b3370e3a2115", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nCisco BroadWorks: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\nCVE-2026-20320 \u00b7 patch by 2026-11-24\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-20320\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mzyedh4npu2o"}, {"timestamp": "2026-11-10T21:31:35Z", "date_only": false, "value": "2026-11-10T21:31:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9W8J-FG77-WHW7", "record": "GHSA-9W8J-FG77-WHW7", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T21:31:54.735Z", "date_only": false, "value": "2026-11-10T21:31:54.735273Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infonewscyber.bsky.social/post/3mzyfbdlwdl2r", "record": "cve-2026-20320", "field": "creation_timestamp", "uuid": "ad92d8ee-a1b4-4bea-9eb7-06f23e1b2a35", "content": "\u26a0\ufe0f FAILLE CRITIQUE\n\nCVE-2026-20320 activement exploit\u00e9e : restriction inad\u00e9quate des r\u00e9f\u00e9rences \u00e0 des entit\u00e9s externes XML dans Cisco BroadWorks\n\n\ud83d\udd17 https://infonewscyber.fr/info/cve-2026-20320-activement-exploitee-restriction-inadequate-des-referen-588033e85e3ec539\n#Cisco #ZeroDay #Cybers\u00e9curit\u00e9", "url": "https://bsky.app/profile/infonewscyber.bsky.social/post/3mzyfbdlwdl2r"}, {"timestamp": "2026-11-10T21:50:16.213Z", "date_only": false, "value": "2026-11-10T21:50:16.213749Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patchsonar.com/post/3mzygc6tbdd2q", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "3694e1fc-4162-4cd2-804e-09a73f72ff9f", "content": "Newly listed by CISA: Cisco BroadWorks\nCisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\n\nWhat to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using\u2026\n\nhttps://patchsonar.com/cve/CVE-2026-20320 #InfoSec", "url": "https://bsky.app/profile/patchsonar.com/post/3mzygc6tbdd2q"}, {"timestamp": "2026-11-10T21:55:06.996Z", "date_only": false, "value": "2026-11-10T21:55:06.996616Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mzygku2bfz2n", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "65afcde7-6417-4ed2-b0f3-13c39fa75930", "content": "\u3010\u60aa\u7528\u78ba\u8a8d\u3011CVE-2026-20320\nCisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\nCisco BroadWorks\nCISA \u8ffd\u52a0 11/10\u30fb\u5bfe\u5fdc\u671f\u9650 11/24\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-20320\n#\u8106\u5f31\u6027 #KEV #Cisco", "url": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3mzygku2bfz2n"}, {"timestamp": "2026-11-10T22:29:27.880Z", "date_only": false, "value": "2026-11-10T22:29:27.880195Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/axnews.bsky.social/post/3mzyiibcr6b26", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "13354b53-ef9a-491d-9305-9de41436942f", "content": "\u26a0\ufe0f Exploited in the wild: CVE-2026-20320\nCisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\nAdded to CISA KEV \u00b7 High 7.5\nhttps://ax-news.com/cve/CVE-2026-20320\n#CVE #KEV #infosec", "url": "https://bsky.app/profile/axnews.bsky.social/post/3mzyiibcr6b26"}, {"timestamp": "2026-11-10T23:00:58.646Z", "date_only": false, "value": "2026-11-10T23:00:58.646590Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mzykamsglg2a", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "4c588a85-ea12-47d3-8574-bd54063d6425", "content": "Attention: new KEV addition. CVE-2026-20320 added to CISA KEV.\n\nCisco BroadWorks OCI XML Parser: unauth remote XXE lets attackers read sensitive config.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-20320/\n\n#fcvulns #KEV", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mzykamsglg2a"}, {"timestamp": "2026-11-11T00:00:47Z", "date_only": false, "value": "2026-11-11T00:00:47.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45362", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "b481dae7-d005-47f3-a40d-f535df90e2bc", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\u00a0\nCVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability\u00a0\nCVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability\u00a0\nCVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability\u00a0\nCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability\u00a0\nCVE-2026-125350 Google Chromium Use-After-Free Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/45362", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T00:00:47Z", "date_only": false, "value": "2026-11-11T00:00:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/45362", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "1e3a99d7-576a-42f7-af9e-2eace8588a51", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability\u00a0\nCVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability\u00a0\nCVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability\u00a0\nCVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability\u00a0\nCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability\u00a0\nCVE-2026-125350 Google Chromium Use-After-Free Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/45362"}, {"timestamp": "2026-11-11T04:01:11.027Z", "date_only": false, "value": "2026-11-11T04:01:11.027430Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mzz2zgagtf2y", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "fad83e72-8766-4ca2-b497-57cad0ea4d42", "content": "~Cisa~\nCISA added six actively exploited vulnerabilities to its KEV Catalog, including Cisco BroadWorks XXE, Barracuda ESG auth bypass, and a Chromium...\n-\nIOCs: CVE-2026-20320, CVE-2026-111560\n-\n#ExploitedVulnerability #PatchManagement #ThreatIntel #VulnerabilityManagement", "url": "https://bsky.app/profile/cyfar.ca/post/3mzz2zgagtf2y"}, {"timestamp": "2026-11-11T04:55:47.088Z", "date_only": false, "value": "2026-11-11T04:55:47.088Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-20320", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-11T04:55:47.088Z", "date_only": false, "value": "2026-11-11T04:55:47.088Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-20320", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T05:04:02Z", "date_only": false, "value": "2026-11-11T05:04:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "7fe8d26a-525e-4fee-bea1-0c198a8df1cc", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.\n\nDetails of the vulnerabilities are below -\n\n\n  CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity", "url": "https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html"}, {"timestamp": "2026-11-11T05:19:43.487Z", "date_only": false, "value": "2026-11-11T05:19:43.487", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20320", "record": "FKIE_CVE-2026-20320", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T06:25:07.289Z", "date_only": false, "value": "2026-11-11T06:25:07.289979Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3mzzd2sqpgz2k", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "b9575952-f467-4d59-ab67-28f71a0ff067", "content": "Do you run Cisco BroadWorks?\n\nCISA lists CVE-2026-20320 as exploited (added 10 Nov 2026).\n\nCan it reach you? Over a network, with no login and no click. CVSS 7.5.\n\nPlain-English breakdown:\nxploitdigest.com/kev/CVE-2026-20320\n\n#Cisco #CyberSecurity #InfoSec #Vulnerability #CVE #KEV #PatchNow", "url": "https://bsky.app/profile/xploitdigest-kev.bsky.social/post/3mzzd2sqpgz2k"}, {"timestamp": "2026-11-11T06:28:02.957Z", "date_only": false, "value": "2026-11-11T06:28:02.957150Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mzzd7zv5pt2h", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "9e9584a3-32fd-4f3e-8f35-00886fca40c1", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 10/11) (suite)\n\u2022 Cisco BroadWorks CVE-2026-20320, CVSS 7.5", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mzzd7zv5pt2h"}, {"timestamp": "2026-11-11T06:30:39.815Z", "date_only": false, "value": "2026-11-11T06:30:39.815363Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mzzdepnx2u2k", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "2bfd6e94-af47-48ef-ace6-230809dcf446", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-20320: \u26a0\ufe0f CVE-2026-20320: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-20320-a-vulnerability-in-the-open-client", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mzzdepnx2u2k"}, {"timestamp": "2026-11-11T07:04:54.033Z", "date_only": false, "value": "2026-11-11T07:04:54.033301Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infonewscyber.bsky.social/post/3mzzfbw3xgw2g", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "a02fcdde-7754-4b6c-940c-278f2bc39bad", "content": "\u2600\ufe0f Le point cyber du 11/11\n93 infos en 24 h dont 7 critiques\n\n\u26a0\ufe0f CVE-2026-111793 activement exploit\u00e9e : Openwave\u2026\n\u26a0\ufe0f CVE-2026-20320 activement exploit\u00e9e : restriction\u2026\n\u26a0\ufe0f CVE-2026-111560 activement exploit\u00e9e : injection de\u2026\n\n\ud83d\udd17 https://infonewscyber.fr\n#Cybers\u00e9curit\u00e9", "url": "https://bsky.app/profile/infonewscyber.bsky.social/post/3mzzfbw3xgw2g"}, {"timestamp": "2026-11-11T08:06:18.361Z", "date_only": false, "value": "2026-11-11T08:06:18.361983Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mzzipqkhi72x", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "0f952c76-018c-4dea-b9d3-9ec885b0d57f", "content": "\ud83e\udd16 CISA KEV, Nov 10: 6 newly exploited flaws. Chrome UAF CVE-2026-125350 (8.8), Cisco BroadWorks OCI-P XXE CVE-2026-20320 (7.5, unauth config file read), Barracuda ESG auth bypass CVE-2026-116606. Patches predate exploitation.\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mzzipqkhi72x"}, {"timestamp": "2026-11-11T08:12:43.877Z", "date_only": false, "value": "2026-11-11T08:12:43.877198Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3mzzj364zlk2g", "record": "CVE-2026-20320", "field": "creation_timestamp", "uuid": "3ad8fe26-63bf-45f4-95ac-bfc10b119683", "content": "CISA : failles #Cisco BroadWorks et #Openwave Webtop Transcoder, exploit\u00e9es malgr\u00e9 des correctifs. CVE-2026-20320 (CVSS 7.5) \u2014 mauvaise restriction d'entit\u00e9 XML externe. \ud83d\udd12 \n\nthehackernews.com/2026/11/cisc...", "url": "https://bsky.app/profile/calimegai.bsky.social/post/3mzzj364zlk2g"}, {"timestamp": "2026-11-24T00:00:00Z", "date_only": true, "value": "2026-11-24", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "evidence.0.details.due_date", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-11T08:19:32.648Z", "anchors": {"origin": {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 7113600.0, "hours": 1976.0, "days": 82.33333333333333, "min_seconds": 7113600.0, "max_seconds": 7200000.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 7113600.0, "hours": 1976.0, "days": 82.33333333333333, "min_seconds": 7113600.0, "max_seconds": 7200000.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 7229972.648015, "hours": 2008.3257355597223, "days": 83.6802389816551, "min_seconds": 7229972.648015, "max_seconds": 7229972.648015, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-19T16:00:00Z", "date_only": false, "value": "2026-08-19T16:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-BWORKS-XXE-UWUD7CET", "record": "CISCO-SA-BWORKS-XXE-UWUD7CET", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T08:19:32.648Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 116372.648015, "hours": 32.32573555972222, "days": 1.3469056483217592, "min_seconds": 29972.648015, "max_seconds": 116372.648015, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-20320", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "86dfc03f-6300-47fb-b649-7ee0e3001876", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-11T08:19:32.648Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}