Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The addition of CVE-2026-111793 to the KEV catalog follows an alert issued by Japan Vulnerability Notes (JPN), which noted in an advisory that the "developer states that attacks exploiting the vulnerability have been observed."

The vulnerability information portal also warned that an authenticated attacker could exploit the vulnerability to upload a specially crafted file and obtain sensitive information.

As for CVE-2026-20320, the security defect has been put to use as part of an agentic attack campaign dubbed Operation Snowball in which an unknown Chinese-speaking threat actor leveraged an autonomous framework built using a jailbroken version of the DeepSeek Flash model to target a European telecom provider and 13 companies hosted on its infrastructure.

The activity resulted in the enumeration of hundreds of assets, extraction of dozens of credential sets, and exfiltration of thousands of rows of subscriber billing and device records from the provider's internal billing platform over a two-week period, according to Malbear Labs.

The AI agent has capabilities to exploit a portfolio of known security vulnerabilities spanning a wide range of products, including -

• JBoss RichFaces (CVE-2013-2165)
• Liferay CE/DXP (CVE-2020-7961)
• ForgeRock OpenAM (CVE-2021-35464)
• Linux (CVE-2021-4034)
• SAP NetWeaver (CVE-2022-22536)
• Cisco Expressway (CVE-2023-20269)
• Citrix NetScaler(CVE-2023-4966)
• Qlik Sense (CVE-2023-41265, CVE-2023-41266)
• PAN-OS GlobalProtect (CVE-2024-3400, CVE-2024-9474)
• Adobe Experience Manager (CVE-2025-54249)
• Broadcom VMware Cloud Director (CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006)
• Claris FileMaker Server (CVE-2026-86934), and
• F5 BIG-IP (CVE-2026-41225)

"The primary target on the telecommunications provider's infrastructure was the BroadWorks XSP (eXtended Services Platform), Release 23.0.1.1075, running on port 2208," Malbear Labs said. "The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser."

"From the XSP host, the agent recovered the system identity private key, three SSL credential sets, and three additional private keys with certificate matches confirmed. The system identity key is used by the BroadWorks platform to authenticate between its own components; possessing it allows impersonation of the XSP in inter-component communication."

The activity has also been characterized by the use of reconnaissance tools, Sliver for post-exploitation, Chisel, along with web shells like Behinder for persistent access.

"This is a threat actor who delegated the intrusion to an AI and checked in asynchronously to review progress," Malbear Labs added. The primary agent ran continuously, issued parallel tasks to worker agents, maintained a coherent operational plan across the full campaign, and adapted to defensive controls without pausing for operator input."

"The harness ran the reconnaissance, identified the attack surface, chose the exploitation path, adapted when controls blocked it, wrote new tools when existing ones failed, extracted credentials, exfiltrated data, and compiled a finished target list, all without the operator present during any of it."

Late last month, Cisco revealed that two different vulnerabilities in Catalyst SD-WAN (CVE-2026-20127, CVSS score: 10.0) Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software (CVE-2026-76418, CVSS score: 8.6) have been actively exploited in the wild.

In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 24, 2026, to secure their networks.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.