Openwave Webtop Media Transcoder file-type restriction bypass exploited, in CISA KEV

CVE-2026-111793 is a flaw in Openwave Messaging's Webtop Media Transcoder. It lets an authenticated user have document types processed and converted even when administrators have restricted them ^1,3. SecurityWeek describes the transcoder as the document-conversion component of Openwave's webmail product ⁴. The vendor rates the flaw CVSS 3.1 4.3 (Medium) ¹; the published CVSS vector records no confidentiality or integrity impact and low availability impact. JVN goes further. It says an authenticated attacker who uploads a crafted file may be able to obtain sensitive information, and it labels the entry Critical ². No source explains the gap between these two assessments.

All versions before 1.1.22.0 are affected ^1,2. The vendor dates that fixed build to 2021-12-06 but did not publish its advisory until 2026-10-07 ¹. Deployments still running older builds are the ones at risk. No source gives exposure counts or says whether the component is internet-facing by default.

On 2026-11-09, JPCERT/CC and IPA published JVNVU#93403064, relaying the developer's statement that attacks exploiting the flaw have been observed ². CISA added the CVE to its KEV catalog on 2026-11-10 with a federal due date of 2026-11-24, and lists ransomware use as unknown ³. The vendor's own advisory does not mention exploitation ¹. No source names an actor, a start date, victim counts or what was accessed. SecurityWeek and The Hacker News cover this flaw alongside Cisco BroadWorks CVE-2026-20320, but neither links the two campaigns ^4,5.

The vendor gives the root cause as the transcoder failing to enforce administrator-defined restrictions on which file types it converts ¹. JVN and CISA classify the weakness as CWE-669, Incorrect Resource Transfer Between Spheres ^2,3. In practice, a control that operators rely on to limit what the transcoder accepts is simply not applied.

Exploitation requires a valid authenticated account ¹; the CVSS vector adds network access and no user interaction. The vendor says the issue arises when the Webmail experience is bypassed, which implies the transcoder is reached directly rather than through the normal webmail flow ¹. The key exposure question is therefore whether any network path reaches the transcoder without passing through the Webmail front end.

The vendor limits the impact to unintended file conversion ¹, and the CVSS vector scores only low availability impact. JVN alone says a specially crafted upload may yield sensitive information ². Until the vendor clarifies, defenders should plan for the broader outcome.

1. 1

   Upgrade Webtop Media Transcoder to 1.1.22.0 or later. The vendor recommends moving to the latest supported Media Server 2.0 release ¹. JVN advises contacting the developer for patch details ²; do so to confirm which build fully addresses this CVE.

2. 2

   US federal agencies must apply vendor mitigations under BOD 26-04, or stop using the product, by 2026-11-24 ³.

3. 3

   Restrict network access so the transcoder accepts requests only from the Webmail front end. This closes the bypass path the vendor describes ¹.

4. 4

   Reduce the authenticated accounts that can reach the transcoder. Disable dormant, shared and test accounts.

5. 5

   Exploitation started on an unknown date, so treat hosts that ran affected builds as possibly compromised. Review transcoder and webmail logs for unexpected conversions and data access, and rotate credentials for any accounts tied to suspicious activity. The CISA entry does not mandate forensic triage ³.

• Inventory Webtop Media Transcoder instances and their build numbers. Any build below 1.1.22.0 is affected ¹. The vendor advisory includes no detection guidance, log signatures or IOCs ¹.
• Map which hosts can send requests to the transcoder. Requests that do not come from Webmail front-end hosts match the reported bypass precondition ¹. Review firewall, load balancer and transcoder access logs for such clients.
• Review transcoder conversion logs for file types outside the administrator-defined allowlist. Their presence shows the restriction was not enforced ¹.
• Correlate transcoder activity with authenticated webmail accounts. Flag accounts that call the transcoder without a matching webmail session, that upload unusual volumes, or that submit unusual file types.
• JVN says sensitive information may be exposed ². Check whether accounts that submitted unusual files then retrieved converted output, and look for repeated or large downloads after conversions.

1. Dec 6, 2021

   Webtop Media Transcoder 1.1.22.0, the first fixed build, released (per the vendor). ¹

2. Oct 7, 2026

   Openwave publishes public security advisory CAN-2026-2032674. ¹

3. Oct 16, 2026

   CVE-2026-111793 record published. ⁴

4. Nov 9, 2026

   JVN publishes JVNVU#93403064, relaying the developer's statement that exploitation has been observed. ²

5. Nov 10, 2026

   CISA adds CVE-2026-111793 to the KEV catalog. ³

6. Nov 11, 2026

   SecurityWeek and The Hacker News report the KEV addition and JVN's exploitation note. ⁴

7. Nov 24, 2026

   CISA KEV remediation due date for federal agencies. ³

1. 1
   Openwave Messaging (Ireland) Ltd - Public Security Advisory (CAN-2026-2032674)

   Openwave Messaging (Ireland) Limited · Vendor · Oct 7, 2026
2. 2
   JVNVU#93403064: Webtop Media Transcoder vulnerable to incorrect resource transfer between spheres

   JPCERT/CC and IPA (Japan Vulnerability Notes) · Government · Nov 9, 2026
3. 3
   CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-111793

   CISA · Government · Nov 10, 2026
4. 4
   Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities

   SecurityWeek · News · Nov 11, 2026
5. 5
   Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

   The Hacker News · News · Nov 11, 2026