93← Home

CVE-2026-111793: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Headline from Openwave Messaging Limited — Webtop Media Transcoder · compiled from 6 sources

Our analysis · checked against 9 sources

Exploited Openwave transcoder flaw rated medium severity; US agencies must patch by November 24

A flaw in Openwave's Webtop Media Transcoder lets a logged-in user convert unintended document types by bypassing Webmail; the official score is 4.3, rated MEDIUM, not critical. It is being actively exploited, and CISA listed it on 10 November, giving federal agencies until 24 November to patch.

The framing"Critical" does fit the urgency: the flaw is actively exploited and CISA set a 24 November patch deadline. But the official NVD/MITRE score is 4.3, rated MEDIUM, with no confidentiality or integrity impact.

What the headline leaves out

  • The official severity is MEDIUM (CVSS 4.3), not Critical.
  • An attacker must be logged in, and the flaw has no confidentiality or integrity impact; availability impact is low.
  • It is actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 10 November.
  • VulDB's CWE-434 classification conflicts with the official CWE-669 record.

What the coverage got wrong

  • Headline/listing convention; VulDB: “The vulnerability is Critical”. NVD/MITRE and wire coverage report CVSS 4.3, baseSeverity MEDIUM; there is no official Critical rating.thehackernews.com

What happens next

The next dated step is CISA's 24 November 2026 patch deadline for US federal civilian agencies. CISA-ADP says agencies should apply vendor mitigations or discontinue the product if none are available. RedPacket Security notes that active use raises the risk despite the limited stated impact. Watch for vendor patch details and any reports of impact beyond service disruption.

Possible knock-on effects
  • The CISA listing could push federal agencies to patch or drop the product, and it may prompt non-federal operators to follow, affecting Webtop users. (official assessment: CISA-ADP guidance under BOD 26-04 says to apply mitigations or discontinue use if none are available.. Watch for: Agency compliance reports or operators announcing patches or removal of the product.)
  • Continued exploitation could disrupt or overload document-conversion services, which may affect webmail users' attachment handling. (named expert: RedPacket Security analysis: the likely impact is disruption or resource consumption; data theft is not established.. Watch for: Outage reports or any evidence of data theft, which would change the assessment.)

Sources: OpenCVE record CVE-2026-111793 (primary), The Hacker News: Cisco BroadWorks and Openwave flaws, Suped: CISA flags exploited Openwave flaw, SecurityWeek: Threat actors exploit Openwave, Cisco BroadWorks vulnerabilities, CVE record via threatint (primary), JVN advisory JVNVU93403064 (primary), RedPacket Security CVE alert, VulDB entry, Strix CVE entry

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

SecurityWeek reports that threat actors are exploiting Openwave (CVE-2026-111793) and Cisco (CVE-2026-20320) flaws to access sensitive information[1]. According to Suped, CISA added the Openwave Webtop bug to its Known Exploited Vulnerabilities catalog after Openwave reported exploitation[2]

Japan Vulnerability Notes says that for CVE-2026-111793, "The developer states that attacks exploiting the vulnerability have been observed."[3] The JVN advisory warns that "if an authenticated attacker uploads a specially crafted file by following specific steps, sensitive information may be obtained."[3]According to the CVE description published on OpenCVE, Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.[4] SecurityOnline reports that Webtop is Openwave's webmail platform, used by service providers[5], and that the transcoder converts attachments so users can preview them in the browser.[5]ThreatINT's CVE record lists the flaw as "MEDIUM: 4.3"[6] on the CVSS scale, classified as CWE-669 Incorrect Resource Transfer Between Spheres[6].SecurityWeek reports that CISA added the Openwave and Cisco security defects to its Known Exploited Vulnerabilities (KEV) catalog on November 10, urging federal agencies to patch both by November 24.[1]According to Suped, Openwave's security advisory and the CVE were already public in October[2], and a fixed build was already available.[2]SecurityOnline reports that the flaw affects all versions before 1.1.22.0[5], and that Openwave recommends moving to "the latest Media Server 2.0 supported release."[5] The outlet adds that administrators should contact Openwave for patch details, as JPCERT/CC advises.[5]

Listen to the songCritical CVEs — November 13, 2026

Sources

  1. [1]Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities - SecurityWeek
  2. [2]CISA flags exploited Openwave webmail attachment flaw - Suped
  3. [3]JVNVU#93403064: Webtop Media Transcoder vulnerable to incorrect resource transfer between spheres
  4. [4]CVE-2026-111793 - Vulnerability Details - OpenCVE
  5. [5]Openwave Webtop Media Transcoder Vulnerability CVE-2026-111793 Exploited in the Wild
  6. [6]CVE-2026-111793

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

CVE-2026-111793: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | 93