CISA Sets November 24 Deadline to Patch Exploited Cisco and Openwave Vulnerabilities

On November 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks. CISA directed federal agencies to remediate both vulnerabilities by November 24, 2026. The deadline makes inventory, risk assessment, patching, and evidence of remediation immediate operational priorities for agencies responsible for affected systems.

The vulnerabilities have different access requirements that can inform triage. The Cisco BroadWorks vulnerability can be exploited remotely without authentication, meaning an attacker does not need a valid account before attempting exploitation. Exploiting the Openwave vulnerability requires an authenticated user. This distinction does not eliminate the risk posed by the Openwave issue, but it gives security teams a useful factor when sequencing assessment and remediation alongside exposure, system criticality, and availability of fixes.

For federal contractors, the directive is relevant wherever contractor-managed or contractor-supported environments connect to or provide services for federal networks. Teams should determine whether either product is present across in-scope systems, including environments managed on behalf of an agency; identify affected versions; apply available fixes; and verify that remediation succeeded. Contractors may also need to coordinate status reporting and supporting evidence with government security and program teams so agencies can meet the November 24 deadline.

The notice is a time-bound cybersecurity compliance signal rather than a new solicitation or contract award. It can prompt near-term work in vulnerability management, asset discovery, patch deployment, configuration review, and remediation validation. Security and IT service providers supporting federal customers should be prepared to help clients establish product exposure, prioritize the unauthenticated remote Cisco vulnerability for urgent review, and document the status of both CVEs. The source does not specify affected product versions, patch details, or separate agency reporting procedures, so organizations should consult vendor and CISA guidance for technical remediation instructions rather than infer them from the deadline alone.

• CISA added CVE-2026-111793 and CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on November 10, 2026.
• Federal agencies have until November 24, 2026 to remediate both vulnerabilities; as of November 11, 13 days remain.
• CVE-2026-20320 affects Cisco BroadWorks and can be exploited remotely without authentication.
• CVE-2026-111793 affects Openwave Webtop Media Transcoder and requires an authenticated user for exploitation.
• Federal contractors should check whether affected Cisco or Openwave products are deployed in systems they operate or support for government customers.
• Apply available fixes and verify remediation; coordinate status and evidence with agency security teams as needed to support the deadline.
• Use access conditions, system exposure, and mission criticality to help sequence assessment, while treating both actively exploited vulnerabilities as remediation priorities.
• The source provides no product-version scope or patch instructions; consult CISA and vendor advisories for authoritative technical details.