Telecom systems face active attacks on sensitive configurations
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, November 12th, 2026.
Telecom and hosted communications environments face active attacks through Cisco BroadWorks. The weakness allows an unauthenticated remote attacker to send crafted XML and read sensitive configuration information. Cisco patched the issue in August, but CISA has now added it to its catalog of exploited vulnerabilities. Federal civilian agencies must remediate it by November 24th, and private organizations were also urged to prioritize action.
BroadWorks supports cloud voice and collaboration services delivered by carriers and managed service providers. Reported attacks targeted a European telecom provider and organizations using its infrastructure, although CISA didn’t disclose its own attack details. For leaders, the first question is whether BroadWorks exposure exists directly or through a communications supplier. For defenders, possible configuration theft means the response may need to examine keys and credentials rather than ending when the patch is installed.
The broader pattern is continued targeting of shared service platforms that can expose multiple customers. Patch BroadWorks and assess exposed configuration data, keys, and supplier dependencies for signs of misuse.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
