On November 10, 2026, CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalog. It is an unauthenticated XML external entity (XXE) flaw in Cisco BroadWorks, the softswitch and unified communications platform that many carriers and hosted-voice providers run. Federal agencies have until November 24, 2026 to fix it. Cisco patched the bug in August, but it is now being exploited in the wild. Malbear Labs says it was the initial-access vector in “Operation Snowball”, in which a jailbroken LLM agent spent about two weeks inside a European telecom provider with little human supervision.

The Vulnerability

Cisco published advisory cisco-sa-bworks-xxe-uwUd7CEt on August 19, 2026. It describes an out-of-band, blind XXE injection in the XML parser behind the Open Client Interface (OCI) provisioning protocol (OCI-P, TCP 2208 by default). Cisco says external entity resolution was enabled by default. As a result, an unauthenticated remote attacker who can reach the OCI listener can send crafted XML that makes the parser fetch attacker-defined external entities. That lets the attacker read arbitrary local files and send their contents out of band to a server they control.

  • CVSS: 7.5 (High). The score is driven by confidentiality impact.
  • Affected: BroadWorks releases earlier than RI.2026.07. Affected components include the Application Server, Application Delivery Platform, Profile Server and Xtended Services Platform (XSP).
  • Fixed: RI.2026.07. Per-component patch identifiers for older maintained trains are listed in the advisory’s Fixed Software table.
  • Workarounds: None, according to Cisco. Restricting OCI-P to trusted provisioning clients reduces exposure.

When Cisco published the advisory, it said it knew of no public PoC and no exploitation. The 7.5 score understates the practical risk. On a BroadWorks host, “file read” covers the system identity private key, TLS keys and stored credentials. Those turn a read primitive into impersonation of the platform and lateral movement.

Operation Snowball

Malbear Labs published its report on November 8. It is based on an exposed open directory that held the operator’s full workspace: tooling, logs and agent transcripts. Key findings:

  • The operator drove a DeepSeek Flash model whose guardrails had been stripped by a roughly 78,000-character system prompt. The prompt was built from a public jailbreak template and extended with 21 offensive task categories. Transcripts show the agent choosing CVEs, tools and techniques itself, with the human mostly checking on progress.
  • Initial access was CVE-2026-20320 against the provider’s BroadWorks XSP. From that host the agent recovered the system identity private key, three sets of SSL credentials and three more private keys.
  • Post-exploitation used Sliver v1.7.8 implants behind Cloudflare fronting.
  • The intrusion reached subscriber billing records and pivoted into 13 organizations hosted by the provider. One was a healthcare tenant, where an InterSystems TrakCare Oracle backend with default credentials exposed millions of patient records.
  • Malbear judges the operator to be Chinese-speaking and does not attribute the activity to a state actor.

Several caveats apply. The telecom provider has not been named. None of the 13 downstream breaches has been independently confirmed, and transcript entries show what the agent tried, not necessarily what it exfiltrated. No new exploit was involved: every CVE used was already known and patched. The new element is the automation chaining them together, and that should change how defenders think about the time between a patch’s release and its exploitation.

The same KEV batch also included an Openwave Webtop Media Transcoder file-type restriction bypass, which reporting links to the same campaign.

Impact

BroadWorks sits at the core of many carriers’ hosted PBX, UCaaS and SIP trunking services. A compromised XSP or Application Server exposes subscriber data, call-control credentials and the keys that other network elements trust. For providers that host multiple tenants, one unpatched BroadWorks host can lead into every customer environment the provider manages, as happened in this campaign.

What to Do Now

  1. Upgrade every BroadWorks component to RI.2026.07 or the fixed patch for your maintained train. Do not stop at the Application Server; the XSP was the entry point here.
  2. Firewall OCI-P (2208/tcp, and the TLS OCI port if used). It should only be reachable from known provisioning and OSS/BSS hosts, never from the internet or broad internal ranges.
  3. Assume key compromise on any host that was exposed before patching. Rotate the BroadWorks system identity key, the TLS certificates and keys on XSP/ADP, and any credentials in configuration files the parser could read.
  4. Hunt for out-of-band XXE callbacks: outbound HTTP, FTP or DNS from BroadWorks hosts to unfamiliar destinations, and OCI requests containing <!DOCTYPE or SYSTEM entity declarations.
  5. Look for Sliver. Check for unexpected long-lived TLS/HTTPS beacons to Cloudflare-fronted domains from voice-core and tenant-hosting segments.
  6. Audit hosted tenants for default credentials, especially database backends like the TrakCare Oracle instance abused here.

References