Cisco BroadWorks is a cloud unified communications platform that telecom carriers and managed service providers use to run cloud PBX and voice services for businesses. The high-severity flaw (CVSS 7.5) is in the Open Client Interface XML parser and lets an unauthenticated remote attacker read sensitive configuration information from the server.
CISA ordered federal civilian agencies to patch by November 24 and urged private organizations to prioritize the fix as well. It also added an Openwave Messaging Webtop Media Transcoder flaw (CVE-2026-111793), fixed in October, which requires an authenticated user.
According to threat intelligence firm Malbear Labs, a Chinese-speaking actor exploited the BroadWorks flaw in a campaign dubbed Operation Snowball, using an autonomous framework built on a jailbroken version of the DeepSeek Flash model. The targets were a European telecom provider and 13 organizations hosted on its infrastructure. The researchers say the agent recovered private keys and credentials and, over two weeks, exfiltrated thousands of subscriber billing and device records.
What to do: organizations running BroadWorks should confirm the August update is installed and rotate keys and credentials if the server was exposed. CISA did not share its own details about the attacks.
