CVE-2026-20320

Sentinel/Defender KQL

let BroadWorksLogs = YourBroadWorksLogTable | where Service == "OCI-P";
BroadWorksLogs
| where Message has_all ("<!DOCTYPE", "SYSTEM", "ENTITY") or Message has_all ("<!ENTITY", "SYSTEM")
| where Message contains "file:///" or Message contains "http://" or Message contains "https://"
| project TimeGenerated, SourceIP, DestinationIP, Message, UserName, ProcessName
| extend DetectionInfo = 'Possible XXE Injection attempt against Cisco BroadWorks OCI-P service'

Splunk SPL

sourcetype=cisco:broadworks:logs service="OCI-P" (("<!DOCTYPE" AND "SYSTEM" AND "ENTITY") OR ("<!ENTITY" AND "SYSTEM")) (file:/// OR http:// OR https://)
| table _time, src_ip, dest_ip, message, user, process
| eval DetectionInfo = "Possible XXE Injection attempt against Cisco BroadWorks OCI-P service"

Sigma

title: Cisco BroadWorks OCI-P XXE Injection Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential XML External Entity (XXE) injection attempts against Cisco BroadWorks OCI-P service.
author: SecBoard
date: 2026/08/19
logsource:
  product: cisco
  service: broadworks
detection:
  selection:
    service: "OCI-P"
    keywords:
      - '<!DOCTYPE'
      - 'SYSTEM'
      - 'ENTITY'
      - 'file:///'
      - 'http://'
      - 'https://'
  condition: selection
level: high

Elastic ES|QL

FROM your_broadworks_logs
WHERE service == "OCI-P"
  AND (("<!DOCTYPE" IN message AND "SYSTEM" IN message AND "ENTITY" IN message) OR ("<!ENTITY" IN message AND "SYSTEM" IN message))
  AND ("file:///" IN message OR "http://" IN message OR "https://" IN message)
| SELECT @timestamp, source.ip, destination.ip, message, user.name, process.name
| APPEND {
    FROM DUAL
    SELECT 'Possible XXE Injection attempt against Cisco BroadWorks OCI-P service' AS detection_info
  }