The Cybersecurity and Infrastructure Security Agency (CISA) has put forth a critical directive mandating federal agencies to address a significant vulnerability in Cisco’s BroadWorks cloud internet telephone platform. This urgent requirement follows recent investigations revealing that Chinese-speaking hackers successfully exploited this flaw to gain unauthorized access to a European telecommunications provider. The deadline for the patch has been set for November 24, 2026, giving agencies a mere two weeks to remediate the issue.
The vulnerability was formally added to CISA’s catalog of Known Exploited Vulnerabilities on November 10. According to preliminary findings released by Malbear Labs, the breach occurred when hackers utilized an artificial intelligence model to penetrate the telecom’s network. Researchers discovered that the attackers accessed sensitive files from an unprotected server belonging to the telecom, including private keys that are essential for verifying identities between various components of the platform.
Malbear Labs emphasized the sophistication of the attack. It reported that the cybercriminals employed a jailbroken version of the DeepSeek AI model, working autonomously for over two weeks within the telecom network. The research team noted that after initially breaching the network using a manipulated XML message, the attackers effectively carried out their operations with minimal human oversight, primarily just assigning tasks and reviewing brief outputs.
Remarkably, the agent used in this hack generated its own tools to sustain its operation, even bypassing endpoint security measures that had been implemented on the network. The report cited logs that provided a glimpse into the cyber operation, indicating that this autonomous agent was able to penetrate even a healthcare database protected merely by default credentials—a significant misstep considering it contained millions of patient records.
The attackers’ methods included mapping out the network by utilizing public internet registry records to identify multiple organizations hosting systems on the telecom provider’s network. The report further indicated alarming vulnerabilities within the infrastructure of the telecom, detailing how public-facing systems often lacked proper security protocols, thus exposing sensitive data.
What’s particularly concerning is that the BroadWorks flaw had been known for some time, with a fix available since August 19. Cisco categorized it as a high-severity issue in a security advisory, revealing that anyone with access to the BroadWorks provisioning interface could potentially exploit it to extract files without requiring any login credentials. This revelation underscores the chilling reality of cybersecurity: vulnerabilities often remain unaddressed even when solutions are available.
Additionally, organizations operating within the United States had previously been victims of the state-backed group known as Salt Typhoon, which has been implicated in numerous cyber intrusions since late 2024. Cisco’s Talos unit previously disclosed that the breaches predominantly resulted from stolen credentials rather than new vulnerabilities, highlighting the ongoing challenges organizations face in safeguarding their networks.
CISA’s directive for swift remediation is aligned with a broader strategy the agency outlined in June. This strategy aimed to establish a more systematic approach to patching vulnerabilities, moving away from rigid timelines to a sliding scale based on the risk posed. In this context, the agency acknowledges that advances in artificial intelligence may further compress the time available for organizations to react after patches are released.
In light of these revelations, the urgency surrounding the need to address vulnerabilities in infrastructure extends beyond mere compliance. It poses a critical challenge to federal agencies and private sector organizations alike, emphasizing the importance of robust cybersecurity measures and proactive threat mitigation strategies to protect sensitive data from opportunistic cyber adversaries. As the landscape of cyber threats continues to evolve, the reliance on automated systems may potentially exacerbate vulnerabilities or, conversely, serve as an effective countermeasure when managed adeptly.
The implications of this incident signal a wake-up call for organizations to reassess their cybersecurity protocols, training, and response plans. As cyber threats grow more sophisticated, the necessity for vigilance and rapid response becomes paramount, with the potential for grave consequences in the event of security failures.