CVE-2026-111793: Exploitation of Openwave Webtop Media Transcoder Vulnerability

## Overview CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities (KEV) catalog on November 10, 2026. This addition indicates a federal deadline for remediation. The vulnerability affects Openwave Messaging Limited's Webtop Media Transcoder, which does not enforce file type restrictions set by administrators. ## Technical Details The vulnerability allows authenticated users to bypass the Webmail experience and process unintended document types. This occurs due to incorrect resource transfer between spheres within the application. The CVSS score for this vulnerability is 4.3, indicating a moderate severity level. ## Impact If exploited, this vulnerability could lead to unauthorized processing of document types that should be restricted. This could result in data exposure or manipulation, depending on the nature of the files processed. The potential for exploitation has been highlighted by reports from The Hacker News, indicating that flaws in Openwave products are actively being targeted despite available patches. ## Mitigation Administrators should review and enforce file type restrictions within the Webtop Media Transcoder. It is crucial to apply any available patches from Openwave Messaging Limited immediately. Regular audits of user permissions and configurations can help mitigate the risk associated with this vulnerability.