CISA Adds Cisco BroadWorks and Openwave Messaging Flaws to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday expanded its Known Exploited Vulnerabilities (KEV) catalog, adding two critical security flaws impacting enterprise infrastructure software, including Cisco BroadWorks and the Openwave Messaging Webtop Media Transcoder. The inclusion of these vulnerabilities comes as the federal agency cites concrete evidence that these security gaps are actively being leveraged in real-world cyberattacks, posing an immediate risk to both government and private sector networks.

The latest update underscores a persistent trend in modern threat landscapes, where enterprise collaboration tools, messaging platforms, and network edge appliances remain prime targets for malicious actors seeking initial access, lateral movement, or espionage opportunities. While CISA’s catalog additions confirm active exploitation, specific details regarding the exact mechanics of these real-world attacks remain scarce. Furthermore, security researchers and federal agencies have yet to publicly attribute the ongoing exploitation campaigns to a specific named threat actor, advanced persistent threat (APT) group, or financially motivated cybercrime syndicate. Intriguingly, vendor advisories concerning the underlying software flaws do not explicitly mention malicious exploitation prior to CISA’s intervention, highlighting a persistent lag between underground exploitation and formal vendor recognition.

This recent catalog expansion arrives amid a broader wave of high-severity vulnerabilities affecting enterprise networking and communication gear. Late last month, networking giant Cisco disclosed that two entirely separate security issues—impacting the Catalyst SD-WAN architecture and Secure Firewall Adaptive Security Appliance (ASA) Software alongside Secure Firewall Threat Defense (FTD) Software—had also fallen victim to active in-the-wild exploitation. Among those previously disclosed issues was CVE-2026-20127, a catastrophic flaw carrying a maximum possible CVSS score of 10.0 in Cisco Catalyst SD-WAN, as well as CVE-2026-76418, an equally concerning vulnerability affecting Cisco’s firewall lineup with a CVSS score of 8.6. The rapid succession of these discoveries emphasizes the immense surface area modern enterprise environments must defend against sophisticated, well-resourced attackers.

In response to the growing threat posed by these actively exploited security gaps, stringent federal directives have been put into motion. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are now under strict obligation to take immediate remedial action. CISA has formally recommended that all federal civilian agencies apply the necessary patches and software updates by November 24, 2026. This deadline is designed to drastically narrow the window of opportunity for attackers before these vulnerabilities can be weaponized at scale against critical government infrastructure.

Beyond federal entities, private sector organizations, managed service providers, and enterprises utilizing Cisco BroadWorks or Openwave Messaging solutions are strongly urged to review their current deployment inventories. Cybersecurity experts consistently advise that organizations treat KEV catalog additions as high-priority signals, prompting emergency patching cycles or the implementation of robust compensating controls where immediate updates are not feasible. As threat actors continue to weaponize zero-day and newly disclosed enterprise software flaws with increasing speed, proactive vulnerability management remains the single most effective defense against systemic network compromise.