The EPSS score of 0.00353 for CVE-2026-20320 is a statistical artifact, not a risk signal. Here's why you should treat this vulnerability as higher-risk than the model suggests, and what to do about it.
This is an XXE flaw in Cisco BroadWorks' OCI-P provisioning interface — a service designed for external reachability, handling unauthenticated XML input from integration partners. The EPSS model assumes attackers who won't bother targeting systems that are hardened or difficult to reach. That assumption breaks completely for provisioning interfaces. These services exist precisely because the business requires them to be reachable from partner networks, which means they live in a threat model where 'attacker sophistication' is not the limiting factor — network adjacency is. An attacker who can send XML to OCI-P doesn't need nation-state capabilities; they need working XXE knowledge, which is baseline testing material available in every Burp Suite edition since 2013.
The more uncomfortable question is why XXE shipped in 2026 at all. The security community declared XXE 'solved' around 2014 — documented, weaponized, and flagged by every SAST tool. That institutional confidence created a feedback loop: tools flag it, reviewers see the flag and assume it's handled, and the vulnerability class stops appearing in risk calculations. The result is代码 that sits in forgotten provisioning layers for years, never audited because it's 'stable' and 'already protected.' The low EPSS score doesn't reflect exploitation difficulty — it reflects that no one is looking at this attack surface with realistic threat modeling.
What you should do: treat any network-adjacent XML parsing endpoint as exploitable XXE until you've verified the parser disables external entity resolution. For OCI-P specifically, confirm the patch has been applied (Cisco has released the fix), but also audit your broader provisioning layer — if OCI-P was exposed with XXE enabled, other integration endpoints likely share the same configuration debt. The gap between EPSS and CVSS here isn't a modeling disagreement; it's evidence that the model's assumptions about attacker behavior don't map to how provisioning interfaces actually function in enterprise environments.