Threat actors are actively exploiting two vulnerabilities, one in Openwave Webtop Media Transcoder and one in Cisco BroadWorks, and both had fixes available before the attacks began.
The two flaws
The BroadWorks bug, CVE-2026-20320, surfaced on August 19 as an out-of-band blind XML external entity injection. Because external entity resolution is permitted by default, an unauthenticated attacker who reaches the Open Client Interface Provisioning service with a crafted XML message can pull sensitive configuration data out of it. A fix arrived with BroadWorks Application Server, Application Delivery Platform, Profile Server and Xtended Services Platform at release RI.2026.07.
The Openwave defect, CVE-2026-111793, stems from administrator-defined file-type restrictions that never get enforced, so an authenticated user can convert document types the policy forbids and reach sensitive information, as the company explains in its advisory. Version 1.1.22.0, shipped in December 2021, carries the patch. Japan’s JVN flagged the flaw as exploited on November 9.
A harness running the intrusion
Malbear Labs published research on November 8 describing an autonomous AI intrusion harness that a Chinese-speaking actor aimed at a European telecommunications provider and customers on its network. As many as 13 organizations may have been in scope, and the work centered on mapping assets, lifting credentials and collecting subscriber billing and device records.
CISA put both flaws on the Known Exploited Vulnerabilities catalog November 10 with a November 24 deadline for federal agencies. Two Barracuda bugs joined the list in the same round, alongside a Chrome zero-day fixed November 9 and an Outlook zero-day Microsoft patched Tuesday.
The older CVE teaches the clearer lesson. A patch from December 2021 is still missing somewhere in production, which is exactly where scanners and threat actors both begin.
