Hackers are exploiting a flaw in Cisco's business phone software

The US cybersecurity agency CISA warned on Tuesday that hackers are actively using a flaw in Cisco BroadWorks. This is software that phone and internet companies use to run cloud phone systems for business customers. Cisco fixed the flaw in August, so the attacks work against systems that never got the update.

What changed

The flaw is tracked as CVE-2026-20320. It lets an attacker send a specially crafted message to the system and make it hand over sensitive files. The attacker does not need a password or any login. Cisco said the software reads certain parts of those messages in an unsafe way by default.

CISA added the flaw to its list of known exploited vulnerabilities. US federal agencies must fix it by November 24. That order covers only federal agencies, but CISA urged all organizations, including private companies, to treat it as a priority.

What the attackers took

CISA did not share details of the attacks. The security firm Malbear Labs did. It said a Chinese-speaking attacker used a jailbroken AI model, DeepSeek Flash, to carry out the break-ins. Jailbroken means its safety limits were removed. The targets were a European telecom provider and thirteen organizations that used its data centers and cloud systems.

The researchers said the attacker pulled out private keys and security credentials. One of them, the system identity key, is how parts of the BroadWorks platform prove who they are to each other. Whoever holds it can impersonate one of those parts. That is why patching alone may not be enough if a break-in already happened.

Who it affects

The main risk sits with phone carriers and managed service providers that run BroadWorks. Their business customers are affected too, because their cloud phone and collaboration services run on that platform. If your phone service does not use BroadWorks, this flaw does not apply to you.

Most business owners will not run this software themselves. The practical move is to ask your provider. The alert box above lists the steps to take and the questions to put to them.

What happens next

Federal agencies have until November 24 to comply. Cisco has a long record on this list. Since November 2021, CISA has added 103 Cisco flaws to its exploited list, and seven of them have also been used by ransomware gangs. It is not yet clear how many other organizations were hit, and CISA has not said who is behind the wider attacks.