BroadWorks: what to ask your provider beyond “updated”
A platform-wide response can hide outstanding components. Connect each BroadWorks service to its owner, installed version and telephony continuity test.
Czytaj po portugalskuBy Pentesty
The new signal comes from the exploitation catalog
CISA added CVE-2026-20320 to KEV on November 10, 2026, based on active exploitation. The entry consulted gives a November 24 federal deadline and marks ransomware campaign use as unknown. A US federal obligation does not automatically apply to Brazilian businesses; use the signal to set priorities according to exposure.
The Cisco advisory, published August 19, describes XXE in the BroadWorks XML parser: a message to OCI-P can allow a remote, unauthenticated attacker to read files with the BroadWorks user’s privileges. Review the provisioning service, beyond checking whether calls remain available.
Require a component-level answer
Cisco lists Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. Its tables identify RI.2026.07 as the first fixed release; the first component’s note covers OCS and OCIOverSoap. The vendor provides no workaround. Consult the full advisory before selecting an update appropriate for your environment.
Build a matrix with one row per instance: component, function, version, owner and integration served. Ask the provider to connect your contracted service identifier to the corresponding rows. A product-level declaration alone does not establish that every instance serving the customer received the change.
Plan the change around the telephony tasks that must continue
Before the maintenance window, select test transactions with the operational owner: complete incoming and outgoing calls, authenticate the expected clients and finish an authorized provisioning change. Include the paths covered by the contract. Adapt this proposed test to the architecture without running commands against third-party services.
Record the previous state, approved change, result for each component and rollback criteria. Agree who will stop the window if a test fails. The discussion of continuity during a management outage helps distinguish administrative access from the task the business needs to perform.
Treat previous exposure as a separate question
A confirmed fixed version answers the question about current software state. To assess the earlier period, request which instances served the service, how provisioning was reachable, what records exist and how long they were retained. Distinguish no detected event from a conclusion limited by missing records.
If an investigation identifies unauthorized access, the response should consider the files and configuration actually reached. Additional changes to secrets or integrations should follow that scope, with assigned owners and continuity tests. A CVE’s presence in the catalog does not establish compromise of your environment.
Close the ticket with information someone can check
A useful response ends with an identified service, the instances addressed and the questions still open. Preserve that distinction when the provider sends another update or changes the platform behind the contract.
- Keep the mapping between the contracted service and verified instances. Attach version evidence and collection time without including unnecessary sensitive configuration.
- Associate each test result with the changed component and its approver. List exceptions, outstanding dependencies and a review date.
- Separate advisory facts, environment observations and investigation hypotheses. Our discussion of AI agent boundaries covers a different research angle; it does not replace verification of this fix.
Frequently asked questions
How do you avoid mixing this ticket with another issue?
Record the product, component and advisory identifier in the request. A statement about another platform does not close the ticket; require its mapping to each instance serving your contract.
How should you set an internal remediation deadline?
Record exposure, dependencies and the decision owner. Agree a window with continuity criteria and exception tracking, without treating a deadline from another context as an automatic obligation.
Can a product version close the ticket?
Request the version for each component and its connection to the contracted service. Also define expected test results and who accepts any exceptions.
What evidence guides the local investigation?
Define the period, instances and available records. Document what each observation supports and which gaps require further investigation before expanding the scope.
Sources and references
- Cisco: BroadWorks advisory
- CISA: KEV catalog, CVE-2026-20320 entry consulted November 11, 2026
- CISA: six vulnerabilities added to KEV on November 10, 2026
Original Pentesty analysis, published November 11, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.