CVE-2026-111793: Openwave Webtop Transcoder exploited

Call: Patch now. It’s being exploited. JVN quotes Openwave: “attacks exploiting the vulnerability have been observed.” CISA added CVE-2026-111793 to KEV on November 10, due November 24. Most readers don’t run this. The ones who do are usually ISPs and carriers running webmail for a lot of mailboxes.

What breaks: Openwave’s advisory says Webtop Media Transcoder “does not enforce administrator-defined file type restrictions.” An authenticated user who goes around the webmail front end can make it convert document types it was told not to. JVN says a crafted upload “may” expose sensitive information. Openwave scores it CVSS 4.3 Medium, and JVN labels it Critical. Exploitation beats both labels.

Who’s hit: Webtop Media Transcoder before 1.1.22.0.

Fix: The odd part: Openwave says 1.1.22.0 was released on 6 December 2021. The advisory only went out on 7 October 2026. If you’re exposed, you’ve been skipping updates for five years. Openwave’s remediation is to upgrade to the latest supported Media Server 2.0 release.

Workaround: None published.

Sources: Openwave advisory CAN-2026-2032674 (opens in a new tab), JVNVU#93403064 (opens in a new tab), CISA KEV (opens in a new tab).

CVE-2026-111793: Openwave Webtop Transcoder exploited

Sources

More from November 2026 patch cycle