CISA adds six exploited vulnerabilities to federal catalog, including BroadWorks

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog on November 10, saying the additions were based on evidence of active exploitation.

The agency's action brings a previously disclosed Cisco BroadWorks vulnerability into a federal security priority list. The entry, CVE-2026-20320, connects the CISA announcement to an earlier vendor advisory about the product.

In its August 19 advisory, Cisco said the vulnerability could expose sensitive configuration information on affected BroadWorks systems. The company said software updates address the vulnerability and that there are no workarounds for it. The vendor's description of the risk and remedy dates to August; the catalog addition is the new November development.

CISA said its Binding Operational Directive 26-04 applies only to Federal Civilian Executive Branch agencies. In its announcement, the agency also encouraged other organizations to use risk-based vulnerability management and prioritize vulnerabilities in the catalog.

The figure of six in CISA's announcement counts vulnerabilities added to the catalog. For the BroadWorks entry, the two documents give different kinds of context: Cisco describes the exposure and remedy, while CISA provides the later exploitation-based classification.