CVE-2026-111793 Openwave Messaging Webtop Media Transcoder Flaw

If you run Openwave Webtop Media Transcoder, apply the vendor's mitigations now. CVE-2026-111793 means the transcoder does not enforce file type restrictions that an administrator set, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-10.

The federal due date is 2026-11-24. Private organizations are not bound by that date, but it is a sensible target.

What happened

Openwave Webtop Media Transcoder is supposed to honor administrator-defined limits on which file types it converts. According to the NVD record, it does not enforce those limits. An authenticated user can therefore process and convert unintended document types if they bypass the Webmail experience.

In plain terms, the restriction lives in the Webmail front end. If someone talks to the transcoder another way, the restriction does not follow them. NVD classifies the weakness as CWE-669, incorrect resource transfer between spheres. NVD published the record on 2026-10-16.

Who is affected

Any deployment of Openwave Webtop Media Transcoder where an administrator relies on file type restrictions is in scope. The attacker needs a valid account, so the risk is highest where many users can log in. That includes large mail platforms, shared tenants, and accounts that might be compromised.

Fixed version numbers are not confirmed in the data we reviewed. Check the Openwave security advisory and the JVN entry for the exact builds.

How serious it is and whether it is exploited

NVD scores it 4.3 MEDIUM with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. Here is what that means:

The score is modest, but the CISA KEV listing is the stronger signal. KEV means CISA has evidence of exploitation. Known ransomware use is listed as Unknown.

The likely impact is abuse of conversion capacity and processing of content you meant to block. Do not treat a medium score as a reason to wait.

What to do now

Work through this list in order:

1. Find every instance. Include test, staging, and forgotten hosts.

2. Apply the vendor's mitigations from the Openwave advisory linked above.

3. Check exposure. Decide whether each instance is reachable from the internet. CISA says stakeholders must evaluate each asset's internet exposure.

4. Follow CISA BOD 26-04 (Prioritizing Security Updates Based on Risk) and its "Forensics Triage Requirements". For cloud services, follow the applicable BOD 26-04 guidance.

5. Stop using the product if mitigations are unavailable.

6. Review logs for conversions of file types you did not allow.

Commands to check exposure

These are generic starting points for a Linux host. Package names and paths vary by install, so adjust them.

dpkg -l | grep -i openwave
rpm -qa | grep -i openwave
sudo find / -xdev -maxdepth 5 -iname '*openwave*' 2>/dev/null
sudo ss -tlnp

The first two list installed packages. The find command locates vendor directories. The ss command shows which services listen on the network, so you can match them to the transcoder.

Next, look for conversion activity that falls outside your allowed types. Replace the log path and the extensions with your own:

sudo grep -ri transcod /var/log/ 2>/dev/null | grep -viE '\.(docx|xlsx|pdf)'

Any hit is a lead, not proof. Compare the timestamp and the account against normal use.

A worked example

Say your mail platform allows only PDF and DOCX conversion. Your admin console shows that rule, and Webmail enforces it.

A user with a valid login sends a conversion request straight to the transcoder instead of through Webmail. The transcoder converts a file type you never allowed. Because the rule was enforced only at the front end, nothing blocked it.

Your triage would be:

• Confirm the transcoder version against the advisory.

• Restrict network access so only the Webmail tier can reach it.

• Apply the vendor mitigation.

• Search logs for unexpected types and review the accounts involved.

Limiting who can reach the transcoder is a sound interim control. It does not replace the vendor fix.

What IT and security learners can take from this

This bug is a classic lesson in where to enforce a control: on the server that does the work, not only in the interface. It also shows why a medium CVSS score and a KEV listing can point in different directions. Analysts weigh exploitation evidence above raw scores. These are core skills for the CompTIA CySA+ CS0-003 exam, which covers vulnerability management and response. You can browse more options in our cybersecurity certifications.

For another patch-now example with a similar triage flow, see our write-up on CVE-2026-20320 in Cisco BroadWorks.

Building a study plan around vulnerability management? Our CySA+ voucher is delivered by email within 12 hours.

Sources

• NVD CVE-2026-111793

• Openwave security advisory (GISOpenwave)

• JVN advisory JVNVU93403064

• CISA Known Exploited Vulnerabilities entry