CISA warns active attacks hit Cisco BroadWorks and Openwave systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming they are under active attack. The flaws affect Cisco BroadWorks telecommunications software and Openwave Messaging Webtop Media Transcoder, both used extensively in enterprise and government communications infrastructure. One Cisco flaw allows unauthenticated attackers to read sensitive system information, while the Openwave vulnerability could let authenticated users bypass security controls to process unauthorized files.

Despite patches being available since August and October 2026 respectively, attackers are successfully exploiting these vulnerabilities in the wild. Federal agencies have been given a November 24, 2026 deadline to apply fixes, highlighting the urgency for all organizations using these systems. The takeaway is clear: available patches aren't being applied fast enough, leaving critical communication infrastructure exposed to ongoing attacks.

What to do: Apply the available patches for Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder by November 24, 2026.