CISA flags Cisco BroadWorks flaw as actively exploited
Nov 11, 2026 · Summarized by Fundy Tech from 3 sources
CISA says attackers are exploiting a Cisco BroadWorks flaw that can expose sensitive configuration data. Federal agencies have until November 24 to patch it.
Key points
- CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities list.
- The flaw affects Cisco BroadWorks and can expose sensitive configuration data.
- Cisco patched the bug in August, but CISA says attacks are ongoing.
- Federal agencies must fix it by November 24, 2026.
Why it matters
BroadWorks is used by telecom carriers and managed service providers to run cloud calling services. If those systems are exposed, business phone and collaboration services could be at risk. Small businesses that rely on hosted telecom services should ask their provider whether this issue is patched.
Who’s affected: Cisco BroadWorks users and managed service providers
What to do
- Ask your telecom provider if BroadWorks is patched.
- Prioritise remediation if you manage BroadWorks systems.
- Restrict administrative access and review exposure.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.