The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence that they are being actively exploited in the wild. The vulnerabilities affect Cisco BroadWorks and the Openwave Messaging Webtop Media Transcoder, prompting urgent attention from network administrators and IT security teams.
CISA announced the addition of these flaws on Tuesday, highlighting the immediate risk they pose to organizations using the affected software. The agency’s KEV catalog serves as a critical resource for identifying vulnerabilities that have been observed in real-world attacks, allowing defenders to prioritize their patching efforts.
One of the identified vulnerabilities is CVE-2026-20320, which carries a CVSS score of 7.5. This flaw is characterized as an improper restriction of XML external entity, a type of security weakness that can potentially allow attackers to access sensitive information or execute unauthorized actions.
Despite the availability of patches to address these issues, the active exploitation of these flaws underscores the importance of timely updates. Organizations are advised to review their systems for exposure to both Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder components to mitigate potential threats.
Security experts recommend that affected entities immediately apply the latest security updates provided by the vendors. By addressing these known exploited vulnerabilities, organizations can reduce their attack surface and protect against ongoing malicious activities.
<small>Source: The Hacker News — read the original story there.</small>
