CISA flags exploited Openwave and Cisco BroadWorks flaws | Magica
CISA flags exploited Openwave and Cisco flaws with fixes already available
Editorial Team
••📖6 min read
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
CISA added both vulnerabilities to its exploited-flaw catalog on November 10; federal civilian agencies face a November 24 remediation deadline.
Openwave’s flaw requires authentication. Its vendor dates the fixed version to December 2021 and public disclosure to October 2026.
Cisco’s flaw needs no authentication. Researchers say it exposed keys used to authenticate a telecom platform component.
The US Cybersecurity and Infrastructure Security Agency, or CISA, added vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to its Known Exploited Vulnerabilities catalog on November 10. Both have software fixes. The new warning makes checking deployed versions a priority for communications providers, while a reported intrusion illustrates how stolen configuration files can expose credentials used to establish trust between systems.
The affected software sits behind services customers may know by their provider’s brand. Openwave Messaging supplies email and messaging platforms to communications service providers; Webtop Media Transcoder handles document conversion associated with its webmail, as this account explains. Cisco’s BroadWorks is a cloud communications platform that carriers and managed service providers use to deliver branded business calling and collaboration services, as described in the reporting on CISA’s warning. Infrastructure operators therefore have responsibility for fixes that matter to downstream customers.
Openwave, Cisco and CISA document these release, disclosure and remediation milestones. Events are shown in order; spacing does not represent elapsed time. Source: Openwave Messaging.
An old Openwave fix, a recent public warning
Openwave’s vulnerability, CVE-2026-111793, affects Webtop Media Transcoder versions before 1.1.22.0. The software fails to enforce administrator-defined file-type restrictions, potentially allowing an authenticated user to bypass the webmail interface and convert unintended document types.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
In its advisory, Openwave says version 1.1.22.0 fixed the issue and was released on December 6, 2021. The same advisory gives October 7, 2026, as the disclosure date. The company recommends upgrading to the latest supported Media Server 2.0 release.
That establishes a nearly five-year gap between the dated fix and public disclosure. It does not establish when individual customers learned about the security issue, whether they received earlier private guidance, or why vulnerable deployments remained in use. The public advisory does not answer those questions.
The vendor rates the flaw medium severity, with a Common Vulnerability Scoring System (CVSS) v3.1 score of 4.3. Yet the Japanese vulnerability notice published through JVN says the developer has observed attacks. It warns that an authenticated attacker following specific steps could upload a specially crafted file and obtain sensitive information. Openwave reported the vulnerability to the incident-response coordination body JPCERT/CC so users could be notified of its solution through JVN.
A medium severity rating does not negate the exploitation warning. Neither notice identifies victims or quantifies the attacks.
Cisco’s configuration files can carry trust
Cisco disclosed CVE-2026-20320 on August 19, 2026. Its security advisory describes an XML external entity vulnerability in BroadWorks’ Open Client Interface parser. External entity resolution is allowed by default, letting a remote attacker send a crafted XML message to the provisioning service and read sensitive files with the privileges of the BroadWorks user. Authentication is not required.
Cisco rates the vulnerability high severity at CVSS 7.5. It identifies four affected components—BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform—and lists RI.2026.07 as the first fixed release for each. Vulnerable releases are affected regardless of device configuration, and Cisco says no workaround addresses the flaw.
The advisory also gives an upgrade route for customers without a service contract, or those unable to obtain fixed software through their seller: contact Cisco’s Technical Assistance Center with the product serial number and advisory URL as evidence of entitlement to a free upgrade. It advises checking memory capacity and whether the new release supports existing hardware and software configurations.
Cisco lists RI.2026.07 as the first fixed release for all four affected BroadWorks components. Source: Cisco.
What the reported telecom intrusion establishes
Malbear Labs, which publishes malware and intrusion research, says in its Operation Snowball analysis that attackers used the Cisco flaw as an entry point into a European telecommunications provider’s network through its BroadWorks Xtended Services Platform, or XSP. The researchers say recovered material included the XSP’s system identity private key, SSL credentials and other private keys. The identity key authenticates communication between BroadWorks components; possessing it would allow impersonation of the XSP, according to the analysis.
Malbear Labs bases its account on an attacker workspace exposed through an open directory, including session transcripts, reconnaissance output and credential caches. It describes a Chinese-speaking operator directing an AI intrusion framework, with automated agents conducting much of the work. The report does not establish the operator’s nationality.
The campaign also involved other vulnerabilities and credentials. Malbear Labs says the provider’s BroadWorks Provisioning Server, which holds subscriber configuration, was separately exposed through an unauthenticated directory listing. It describes subscriber billing and device records taken from an internal billing platform. These are distinct exposures and outcomes; they should not all be treated as direct effects of the XML parser flaw.
The analysis names 13 organizations hosted on the provider’s infrastructure as within the campaign’s scope, based on the agent’s own attribution using public registry records. That is a target list, not a verified count of organizations breached through the Cisco vulnerability.
CISA’s catalog establishes that the Cisco vulnerability has been exploited; it does not identify the attacker or validate Malbear Labs’ account of autonomous operation. Nor do these sources connect the Openwave attacks to that campaign.
The November 24 deadline leaves a recovery question
CISA’s November 24 remediation deadline for both flaws applies to Federal Civilian Executive Branch agencies; the agency also encourages other organizations to prioritize catalog vulnerabilities. Its entries direct operators to follow vendor instructions and evaluate each asset’s internet exposure. Both list ransomware use as unknown and mark forensic triage under the federal directive as not required. Those fields do not establish that an individual installation has escaped compromise.
Cisco’s retained August advisory still says its security response team was unaware of malicious use. That statement describes an earlier state of knowledge; CISA’s November addition supplies the later exploitation warning.
The next decision is whether updating software is sufficient for a particular installation or whether evidence of earlier access requires recovery work too. Malbear Labs’ account makes the distinction consequential: if authentication keys were stolen before an update, closing the file-reading vulnerability alone would not establish that those keys remain trustworthy.
The cited sources provide no reliable count of vulnerable installations, patch uptake or victims across either flaw. That prevents an estimate of remaining exposure. Operators can verify deployed versions against the vendor advisories now; evidence of prior access and credential theft is needed to determine what else a compromised system requires.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
