Vulnerability details

CVE-2026-111793

Actively exploited

Openwave Messaging (Ireland) Webtop Media Transcoder

CVSS 3.1

4.3Medium

Remedy

Required action (CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (due: 2026-11-24)

Versions not listed as affected in the CVE record:

Webtop Media Transcoder — version 1.1.22.0 and later

Official description

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

CVSS scores

Score	Version	Source	Vector
4.3Medium	3.1	CVEProject cvelistV5 (CNA) (mitre)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L`

Affected products

Vendor	Product	Versions	Source
Openwave Messaging (Ireland) Limited	Webtop Media Transcoder	v < 1.1.22.0	CVEProject cvelistV5 (CNA)

References and advisories

https://openwave.ai
https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md
https://jvn.jp/en/vu/JVNVU93403064/ third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111793 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-16
Last updated: 2026-11-11
State: Published
Assigner (CNA): mitre
Kolun priority: 59 · Medium

CISA KEV catalog

Date added: 2026-11-10
Due date: 2026-11-24
Used in ransomware: Unknown

Exploit prediction (EPSS)

0.63%

Probability of exploitation in 30 days

51%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Partial

Weaknesses (CWE)

CWE-669
Incorrect Resource Transfer Between Spheres