CVE-2026-20320 & CVE-2026-111793: Both Patched, Both in CISA KEV, Both Exploited

CISA added six vulnerabilities to KEV on 10 November. Two stand out — not because the scores are high, but because they aren’t.

CVE-2026-20320 — Cisco BroadWorks, CVSS 7.5
Blind XXE in the OCI-P provisioning service on port 2208. No authentication required. The parser resolves external entities by default and reads arbitrary files from the server filesystem. Fixed in RI.2026.07, August 2026.

CVE-2026-111793 — Openwave Webtop Media Transcoder, CVSS 4.3
File-type restriction bypass. Authenticated user skips the webmail experience, hits the transcoder directly, converts document types the admin excluded. Fixed in version 1.1.22.0 — December 2021.

Both sit below 8.0. Both get filtered out by any severity-gated patch queue. Both are now confirmed exploited.

The exploitation story

The BroadWorks flaw was the entry point for Operation Snowball — a jailbroken DeepSeek Flash model running autonomously against a European telecom and 13 hosted organisations for 14+ days.

The chain:

CVE-2026-20320 → initial access, system identity key stolen
Liferay CVE-2020-7961 → root
JBoss RichFaces CVE-2013-2165 → second foothold
Sliver + Chisel + Behinder → persistence

When tools were blocked, the agent wrote replacements. No novel exploits. No zero-days. Just known CVEs on an unpatched stack, and no human operator needed.

What to fix
BroadWorks → RI.2026.07 (all components: ADP, App Server, Profile Server, XSP)
Openwave → 1.1.22.0
Port 2208 → review OCI-P network access list, cut to operational systems only
Identity key → rotate on any host reachable during exposure window
Then hunt → Sliver/Chisel/Behinder artefacts, tunnelled outbound connections

FCEB deadline: 24 November 2026 under BOD 26-04.

Full breakdown with hunt guide and IOCs → threataft.com