What happened
CWE-611 improper restriction of XXE in Cisco BroadWorks. CISA added CVE-2026-20320 to KEV on 2026-11-10 with confirmed in-the-wild exploitation. Malbear Labs' 'Operation Snowball' report identifies this exact XXE as the agent's entry into the European telecom provider.
Why it matters
Beyond the enterprise exposure, this is a concrete example of an AI agent autonomously selecting and exploiting a specific CVE from its toolkit. It links a KEV-listed, confirmed-ITW network product to the agentic attack trend.
Attack vector
An unauthenticated remote attacker sends a crafted XML request triggering an external-entity resolution, reading sensitive configuration. Confirmed exploited in the wild (CISA KEV addition 2026-11-10); observed weaponized by a jailbroken AI agent.
Affected systems
Cisco BroadWorks (patch released Aug 2026)
Mitigation
Apply the Cisco BroadWorks security fix (cisco-sa-bworks-xxe-uwUd7CEt); CISA federal due date 2026-11-24.