CISA said on Tuesday it added six flaws to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Cisco BroadWorks and Openwave Webtop Media Transcoder are among them. The rest cover Barracuda, Microsoft Outlook and Google Chromium. Cisco's flaw, CVE-2026-20320, scores 7.5 on CVSS. Cisco says a crafted XML message sent to BroadWorks' provisioning service can expose files without a login. The Hacker News said Cisco fixed it in August. It also reported that the Openwave flaw, scored 4.3, needs a login: a user who skips the webmail screen can make the transcoder convert unintended document types. That was fixed in October.
The Hacker News said there are no details on how attackers use the flaws, and no named group is tied to them. Cisco's advisory reports no known malicious use. The sources do not say who is attacked, how many systems are hit, when it began, or whether patched systems were hit.
A low score does not mean low risk once CISA lists a flaw. CISA says it lists flaws on evidence of active exploitation, which can come after the vendor advisory and the patch. Readers can ask: do we run BroadWorks or Openwave, are the August and October fixes applied, and did we check for compromise before patching? CISA says its directive BOD 26-04 sets that check for federal agencies and urges all organisations to adopt risk-based vulnerability management.