The U.S. Cybersecurity and Infrastructure Security Agency added two security vulnerabilities affecting Cisco BroadWorks and Openwave systems to its catalog of known exploited flaws. Officials instructed government agencies to apply patches before late November 2026.

Key Developments and Technical Context

The U.S. Cybersecurity and Infrastructure Security Agency added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog on Tuesday.

CVE-2026-20320 in Cisco BroadWorks carries a CVSS score of 7.5 and received a vendor fix in August 2026.

CVE-2026-111793 in Openwave holds a CVSS score of 4.3 with a patch issued in October 2026.

Federal Civilian Executive Branch agencies are recommended to apply the patches by November 24, 2026.

Strategic Analysis and Industry Implications

The inclusion of moderate to high CVSS flaws in the exploited catalog highlights that attackers are actively scanning for and leveraging unpatched weaknesses in enterprise infrastructure.

Outlook and Key Factors to Watch

Details regarding the exact attack methods and the identity of the threat actor groups conducting these real-world campaigns remain unknown.

Cisco's advisory did not mention any malicious usage associated with the BroadWorks vulnerability at the time of publication.