CVE-2026-20320

{
  "etk_id": "ETK-2026-3989",
  "cve_id": "CVE-2026-20320",
  "display_id": "CVE-2026-20320",
  "ghsa_id": "GHSA-9w8j-fg77-whw7",
  "euvd_id": "EUVD-2026-62586",
  "status": "published",
  "anchor_state": "anchored",
  "title": "External XML entity injection in Cisco BroadWorks OCI parser",
  "summary": "Cisco BroadWorks systems exposing the OCI-P service are affected by an XXE flaw in the Open Client Interface XML parser. An unauthenticated remote party may obtain sensitive configuration data or files readable by the BroadWorks service account when OCI-P can be reached.",
  "mitigation": "Restrict OCI-P access to trusted management networks and disable external XML entity resolution where the deployment permits it. Apply Cisco-provided remediation when a fixed release is identified.",
  "vendor": "Cisco",
  "product": "BroadWorks",
  "affected": [
    {
      "affected_notes": [
        "N/A"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Cisco BroadWorks",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0039,
  "epss_percentile": 0.3287,
  "epss_asof": "2026-11-09",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.599470166666666,
  "t0_at": "2026-08-19T16:39:04.920000+00:00",
  "signals": {
    "kev": {
      "at": "2026-11-08T00:00:00+00:00",
      "days": 81,
      "is_lower_bound": false,
      "measured_at": "2026-08-19T16:39:04.920000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-20320"
    },
    "trigger_signal": {
      "at": "2026-11-08T00:00:00+00:00",
      "days": 80.30619305555555,
      "is_lower_bound": false,
      "measured_at": "2026-08-19T16:39:04.920000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-20320"
    }
  }
}