Is CVE-2026-111560 exploited in the wild?

Yes. CVE-2026-111560 is known to be exploited in the wild, first recorded on 10 November 2026. Treat it as urgent.

How severe is CVE-2026-111560?

Critical severity, with a CVSS score of 7.5, published 19 August 2026.

Which products and versions are affected?

Cisco BroadWorks Application Delivery Platform earlier than RI.2026.07; Cisco BroadWorks Application Server earlier than RI.2026.07; Cisco BroadWorks Profile Server earlier than RI.2026.07; Cisco BroadWorks Xtended Services Platform earlier than RI.2026.07.

Is there a fix for CVE-2026-111560?

A patch was published on 2026-08-19: Fixed in RI.2026.07 for all affected products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111560 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-111560?

Check whether you run Cisco Broadworks, Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111560: Cisco BroadWorks XXE injection in OCI XML parser

CVE-2026-111560 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2026-08-19

Cisco BroadWorks is a telecommunications platform used by service providers to deliver voice, messaging, and collaboration services to enterprise and consumer customers. An unauthenticated attacker can exploit an XML parsing flaw to read sensitive configuration files and data from the affected system by sending a specially crafted message to the provisioning service, potentially exposing credentials and system details that could lead to further compromise.

Vendors: Cisco.

Quick answers

Is CVE-2026-111560 exploited in the wild?: Yes. CVE-2026-111560 is known to be exploited in the wild, first recorded on 10 November 2026. Treat it as urgent.
How severe is CVE-2026-111560?: Critical severity, with a CVSS score of 7.5, published 19 August 2026.
Which products and versions are affected?: Cisco BroadWorks Application Delivery Platform earlier than RI.2026.07; Cisco BroadWorks Application Server earlier than RI.2026.07; Cisco BroadWorks Profile Server earlier than RI.2026.07; Cisco BroadWorks Xtended Services Platform earlier than RI.2026.07.
Is there a fix for CVE-2026-111560?: A patch was published on 2026-08-19: Fixed in RI.2026.07 for all affected products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111560 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-111560?: Check whether you run Cisco Broadworks, Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an XML External Entity (XXE) injection vulnerability (CWE-611) in the Open Client Interface (OCI) XML Parser component of Cisco BroadWorks. The root cause is that XML external entity resolution is enabled by default, allowing an attacker to craft malicious XML messages that reference external entities. An unauthenticated remote attacker can send a crafted XML message to the OCI-Provisioning (OCI-P) service over the network without any authentication or user interaction. Successful exploitation allows the attacker to read arbitrary files from the filesystem with the privileges of the Cisco BroadWorks process. Patches are available in RI.2026.07 and later releases for all affected products.

Affected products

Cisco BroadWorks Application Delivery Platform earlier than RI.2026.07
Cisco BroadWorks Application Server earlier than RI.2026.07
Cisco BroadWorks Profile Server earlier than RI.2026.07
Cisco BroadWorks Xtended Services Platform earlier than RI.2026.07

Identifiers

CVE-2026-111560
CVE-2026-125350
CVE-2026-20320
CVE-2026-124194
CVE-2026-116606
CVE-2026-111793

Timeline

2026-08-19: disclosed: Vulnerability publicly disclosed by Cisco PSIRT
2026-08-19: patched: Fixed in RI.2026.07 for all affected products

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.