CISA has added CVE-2026-111793 to its Known Exploited Vulnerabilities catalog. The flaw is in Openwave Webtop Media Transcoder, which does not enforce the file-type restrictions administrators set. According to NVD, an authenticated user who bypasses the Webmail experience may be able to convert document types the administrator meant to block.
What Is It
CVE-2026-111793 is an incorrect resource transfer between spheres vulnerability (CWE-669) in Openwave Messaging's Webtop Media Transcoder. According to NVD, the transcoder does not enforce administrator-defined restrictions on which file types may be converted. An authenticated user who bypasses the Webmail experience may be able to process and convert document types the administrator did not intend to allow.
NVD lists a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. That means it can be exploited over the network with low complexity, needs low privileges and no user interaction, and has a low impact on availability.
Why It Matters
The CVSS score is moderate, but CISA KEV confirms active exploitation. CISA added the CVE to the catalog on 2026-11-10. CISA's SSVC assessment, also dated 2026-11-10, rates exploitation as active, automatable as no and technical impact as partial.
Known ransomware campaign use is listed as Unknown. The KEV entry marks forensic triage as No.
For organizations covered by CISA's directives, the remediation due date is 2026-11-24.
What's Vulnerable
- Vendor: Openwave Messaging Limited (NVD lists the vendor as Openwave Messaging (Ireland) Limited)
- Product: Webtop Media Transcoder
- Platform: Linux
- Affected versions: all versions before 1.1.22.0
- CPE:
cpe:2.3:a:openwave:webtop_media_transcoder:*:*:*:*:*:*:*:*(versionEndExcluding 1.1.22.0)
Patch Status
The NVD record lists versions before 1.1.22.0 as affected, so deployments on 1.1.22.0 or later fall outside the stated affected range. Check the vendor advisory to confirm the fixed release and any mitigation steps.
CISA's required action is to apply mitigations in accordance with vendor instructions. This must comply with CISA's BOD 26-04 ("Prioritizing Security Updates Based on Risk") and its Forensics Triage Requirements. Follow the applicable BOD 26-04 guidance for cloud services, or stop using the product if no mitigations are available. Stakeholders are responsible for evaluating each asset's internet exposure and following BOD 26-04 patching guidelines. Federal agencies should complete remediation by 2026-11-24.
Sources
- CISA Known Exploited Vulnerabilities Catalog – CVE-2026-111793
- NVD – CVE-2026-111793
- Openwave Security Advisory CAN-2026-2032674
- JVN – JVNVU93403064
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements)
- Openwave Product Page