CISA adds CVE-2026-20320 to KEV, federal remediation due November 24
CVE-2026-20320 is an XXE in Cisco BroadWorks. CISA added it to the KEV and set a remediation due date of November 24, triggering mandatory federal remediation timelines.
- Urgency
- L4
- 64
- 80
- 40
- 20
- 85
At a glance
CISA added CVE-2026-20320, an XML external entity vulnerability in Cisco BroadWorks, to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure affected systems by November 24. Cisco’s advisory lists CVE-2026-20320 as an Out-of-Band Blind XML External Entity Injection. The KEV listing signals active exploitation and requires priority remediation and mitigations.
- CVE-2026-20320 is an XXE in Cisco BroadWorks. CISA added it to the KEV and set a remediation due date of November 24, triggering mandatory federal remediation timelines.
CHRONOS Wire · November 11 · Alert 14
What happened
CISA added CVE-2026-20320, an XML External Entity vulnerability in Cisco BroadWorks, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to secure affected systems by November 24. Cisco published an advisory describing the issue as an XML external entity injection (XXE). CISA’s KEV listing means the vulnerability is being treated as actively exploited and must be prioritised for patching or mitigations.
Why it matters
The KEV listing invokes a two-week federal remediation window, requiring immediate prioritisation by affected organisations and federal agencies to meet the November 24 deadline.
CHRONOS Bottom Line
Federal agencies must remediate CVE-2026-20320 by November 24 under the KEV/BOD process, and organisations running Cisco BroadWorks should prioritise applying Cisco fixes or mitigations immediately.
Full detail
What changed
CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog and set a remediation due date of November 24. Cisco published an advisory describing CVE-2026-20320 as an XML external entity vulnerability in BroadWorks.
What is genuinely new
CISA’s addition of CVE-2026-20320 to the Known Exploited Vulnerabilities catalog and the explicit two-week remediation deadline (due November 24) are the new developments.
Detailed analysis
Cisco’s advisory identifies CVE-2026-20320 as an XML external entity injection in BroadWorks. CISA’s KEV addition and the associated BOD instruction require federal agencies to remediate by November 24, indicating the vulnerability is being treated as actively exploited and should be prioritised. The public sources cited do not include granular exploitation telemetry or confirmed victim lists.
U.S. Impact
Current impact
Low
CISA added the CVE to the KEV and set a remediation due date, indicating active prioritisation but specific US victim telemetry is not published in the cited sources.
Potential impact
Low
Federal Civilian Executive Branch agencies are required to remediate within the two-week BOD window, creating immediate operational patching and triage demand.
- Impact type
- Direct
- Confidence
- High
U.S. Impact is an analytical assessment of the estimated current and potential effects on the United States. It is not a probability forecast.