An explainer for a flaw in Webtop Media Transcoder, the function that, per the advisory, converts documents for webmail in Openwave Messaging's platform, where file-type restrictions are not enforced. The score is low but attacks have been observed, so this short note is for operators of messaging platforms that use Openwave Messaging: how to check and what to do.
- CVE
- CVE-2026-111793 (vendor advisory CAN-2026-2032674, JVNVU#93403064)
- Severity
- Vendor and CVE: CVSS v3.1 4.3 (Medium). JVN: labelled critical
- Type
- Incorrect resource transfer between spheres (CWE-669). Administrator-defined file-type restrictions are not enforced
- Affected
- Webtop Media Transcoder before 1.1.22.0 (the CVE record lists Linux)
- Fix
- 1.1.22.0. The vendor tells customers to upgrade to the latest supported Media Server 2.0 release
- Impact as described
- Vendor and CVE: unintended document types can be converted (low availability impact). JVN: sensitive information may be obtained
- Dates
- Differ by source (see the table below)
- Exploitation
- JVN: the developer states attacks were observed. Added to CISA KEV on 10 November (due 24 November)
What the vulnerability is
The vendor advisory and the CVE record say Webtop Media Transcoder does not enforce the file-type restrictions an administrator has set. An authenticated user who bypasses the Webmail interface may be able to process and convert unintended document types. The advisory does not give the method and this site does not either.
The impact is worded differently by source, and this site does not side with either.
| Source | What it says |
|---|---|
| Vendor advisory and CVE record | Unintended document types can be converted. The advisory gives CVSS v3.1 4.3; the vector is in the CVE record (no confidentiality or integrity impact, low availability) |
| JVN | An attacker who can log in and uploads a crafted file may obtain sensitive information. Labelled critical. The developer states attacks were observed |
| CISA KEV | An authenticated user may process and convert unintended document types (same wording as the vendor) |
The dates differ
| Source | Date |
|---|---|
| Vendor advisory | Disclosure date 7 October 2026. States the fixed version 1.1.22.0 was released on 6 December 2021 |
| CVE record | Published 16 October 2026 |
| JVN | Published and last updated 9 November 2026 |
| CISA KEV | Added 10 November 2026 (due 24 November) |
There is a gap of more than four years between the advisory date (2026) and the stated release date of the fix (2021). This site could not confirm the reason from public information and does not settle on any one date.
Who is affected
| Item | Detail |
|---|---|
| Product | Openwave Messaging Webtop Media Transcoder |
| Affected versions | Before 1.1.22.0 |
| Fix | 1.1.22.0. The vendor tells customers to upgrade to the latest supported Media Server 2.0 release |
| Workaround | None listed in the advisory |
| Procedure and download | JVN refers readers to the developer |
How to check whether you are affected
Check the Webtop Media Transcoder version
Check the running version in your platform's configuration records or through the vendor's support contact. Before 1.1.22.0 means affected. If production, staging and standby systems are separate, check each (Asset inventory checklist).
List the routes that can reach the conversion function
Check whether the conversion function can be reached directly, not only through the Webmail interface, for example from internal or subscriber networks or through an API.
What to do today
Confirm the version and ask the vendor for the fix
If affected, upgrade to 1.1.22.0 or later (the latest supported Media Server 2.0 release) as the vendor advises. Ask the vendor how to obtain it and about upgrade precautions. The KEV due date is 24 November.
Until then, narrow what can reach it
The advisory lists no workaround. As this site's own addition, limit the sources that can reach the conversion function to what the Webmail platform needs. This does not replace the update.
Look for unexpected conversions or uploads
In the conversion logs, look for document types the administrator has not allowed, calls that do not come through the Webmail interface, and unusually high volumes. JVN mentions obtaining information, so do not stop at updating; record the scope and period you checked. The process is laid out in The vulnerability remediation playbook.
Exploitation status
- JVN says the developer states that attacks exploiting this vulnerability have been observed. The vendor advisory does not mention exploitation.
- CISA added it to KEV on 10 November 2026 with a due date of 24 November (KEV version 2026.11.10). Ransomware use is recorded as Unknown and forensic triage as No.
- The CVE record carries CISA's assessment (exploitation active, not automatable, partial technical impact).
- No public information on scale, methods or damage could be confirmed.
Sources
- Openwave Messaging (Ireland) Ltd — Public Security Advisory CAN-2026-2032674 (affected versions, fixed version, CVSS 4.3, disclosure date)
- JVN — JVNVU#93403064 (published 9 November 2026; statement that attacks were observed)
- CVE.org — CVE-2026-111793 (published 16 October 2026; includes CISA's addition)
- CISA KEV — Known Exploited Vulnerabilities Catalog (added 10 November, due 24 November)
Last verified: 11 November 2026.
Read next
- Practice: The vulnerability remediation playbook / Asset inventory checklist
- Deciding: Prioritising with CVSS, EPSS and KEV
- Terms: What is CVSS?