Cisco BroadWorks CVE-2026-20320 Exploited: Secure Cloud Calling

How does the BroadWorks XXE attack work? The OCI interface accepts XML requests. A vulnerable parser processes "external entities" defined inside that XML, so an unauthenticated attacker can send a crafted request that makes the server read local files and return them. Depending on the source, the impact is described as reading sensitive configuration information or sensitive files from the filesystem, with the privileges of the BroadWorks service. On a calling platform, that can include credentials, keys and subscriber data.

According to research by Malbear Labs, reported by The Hacker News, the flaw was used in a campaign the researchers call "Operation Snowball." Their findings:

• An unidentified, Chinese-speaking actor ran an autonomous AI attack framework built on a jailbroken large language model.
• The target was a European telecom provider and 13 companies hosted on its infrastructure.
• Over about two weeks, the attackers enumerated hundreds of assets, extracted dozens of credential sets and exfiltrated thousands of rows of subscriber billing and device records.
• The main entry point was a BroadWorks XSP server listening on port 2208, and the attackers then deployed the Sliver and Chisel tools and Behinder web shells.

These are the researchers' claims and have not been independently confirmed, but the pattern is clear. One unpatched provider exposed thirteen of its business customers at once. Those customers did nothing wrong on their own networks. That is the core challenge of cloud telephony security: your risk depends on the operator's patching, segmentation and monitoring, and most contracts give you no visibility into any of it.

The right response depends on whether you operate BroadWorks yourself or buy services built on it. Both groups have work to do this week.

If you run BroadWorks (operators, resellers, large enterprises):

1. Apply Cisco's fixed release now. Check the Cisco advisory for the release that fixes CVE-2026-20320 on your platform stream and treat the CISA deadline of November 24 as your own.
2. Take OCI and XSP interfaces off the internet. Restrict ports such as 2208 to management networks and known provisioning systems, behind a firewall or VPN.
3. Hunt for compromise. Review web and OCI logs for XML requests containing DOCTYPE or ENTITY declarations, and scan XSP servers for web shells, unknown tunneling tools and unusual outbound connections.
4. Rotate secrets. If there is any sign of access, rotate administrator and provisioning credentials, API keys, SIP credentials and TLS certificates, not just passwords.

If you buy cloud PBX or UCaaS from a provider:

1. Ask your provider in writing whether its platform uses BroadWorks and whether the August 2026 fix is applied on every server.
2. Reset SIP and portal credentials for administrators and devices if the provider cannot give a clear answer.
3. Turn on fraud controls. Block or cap international and premium-rate calling, and review call detail records for unusual patterns. Stolen SIP credentials often end in toll fraud.
4. Check for Openwave Webtop. If you use it for messaging, update the Media Transcoder to version 1.1.22.0 or later.

Why invest in hardening cloud calling instead of waiting for the next advisory? Because voice is now a data system. A modern cloud PBX and call center holds the company directory, call recordings, customer phone numbers, billing records and credentials that open other doors. Protecting it delivers measurable benefits:

• Protected customer data. Subscriber and call records are personal data under GDPR, Brazil's LGPD and Colombia's data protection law. Preventing their theft avoids notification costs, fines and reputational damage.
• Lower toll fraud risk. Fraud controls and credential hygiene stop attackers from turning stolen SIP accounts into thousands of dollars of international calls in a single weekend.
• Business continuity. Patched, segmented platforms are far less likely to need emergency shutdowns that leave sales and support teams without phones.
• Supplier accountability. Clear security requirements in telephony contracts, such as patch timelines, interface exposure and incident notification, turn provider risk into something you can measure and audit.
• Faster detection. Feeding telephony logs into a SOC means an intrusion like Operation Snowball is spotted in hours, not after weeks of quiet data theft.

The organizations hit hardest by provider-layer attacks are the ones that treat telephony as a utility. The ones that come through safely treat it as part of their security perimeter.

HIT Communications has operated enterprise telecom and IT services for more than 30 years in Latin America, the United States and Europe, so we see both sides of this problem: the carrier platform and the business that depends on it.

Our cloud PBX and call center services and SIP trunking and voice traffic are built with security controls from day one, including restricted management interfaces, strong SIP authentication, fraud limits by destination and continuous patching of the platform layer. We answer the questions in this article in writing, for every customer.

Our managed cybersecurity services, including SOC, SIEM and MDR, monitor telephony and network logs 24/7 for the indicators described above, from malicious XML requests to tunneling tools and abnormal call patterns. And because HIT also designs and operates enterprise networks, we can segment voice traffic and protect management access across every site with SD-WAN and managed connectivity.

The result is one accountable partner for voice, network and security, instead of a provider you have to take on trust.

CVE-2026-20320 shows that a three-month-old patch can still become a breach when a provider does not apply it. Attackers used a Cisco BroadWorks XXE flaw to reach a telecom operator and the business customers hosted on its platform, and CISA now lists it as actively exploited. Operators should patch, restrict and hunt this week. Businesses should ask their providers direct questions, rotate credentials and turn on fraud controls.

If you are not sure how your cloud phone system is protected, or you want a telephony platform where security is part of the service, contact HIT Communications today. Our specialists can review your voice and UCaaS exposure and recommend a secure path forward.