Openwave Webtop Media Transcoder: CVE-2026-111793 Exploited

What it is and who is affectedOpenwave Messaging Limited's Webtop Media Transcoder carries a vulnerability tracked as CVE-2026-111793, classified as a...

What it is and who is affected

Openwave Messaging Limited's Webtop Media Transcoder carries a vulnerability tracked as CVE-2026-111793, classified as an incorrect resource transfer between spheres issue (CWE-669). In plain terms, the component is meant to enforce the file-type restrictions an administrator defines, so that only approved document types get converted. According to the NVD, it fails to apply those restrictions, which means an authenticated user who bypasses the Webmail experience may be able to process and convert document types that were never meant to be handled.

The affected range published by the NVD is openwave webtop_media_transcoder up to 1.1.22.0 (excluded). The flaw was published to the NVD on 16 October 2026, and its severity is CVSS 3.1 4.3 (MEDIUM), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. Note the privilege requirement: this is not an anonymous attack, it needs a valid authenticated account. That does not make it harmless — a single compromised or low-privilege mailbox can be enough of a foothold in a corporate webmail deployment.

In practical terms, this concerns organisations running Openwave Webtop with the media transcoding component, typically larger mail infrastructures or managed hosting environments. A Catalan SME or ecommerce business is unlikely to run it directly, but it may inherit it through a hosting provider, a group mail platform or an acquired subsidiary. It is worth confirming rather than assuming.

Why it is urgent: already exploited in real attacks

The decisive fact is not the CVSS score. CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, which means there is confirmed evidence of exploitation in real attacks. A medium-severity flaw that is being actively used deserves more attention than a theoretical critical one that nobody has touched.

CISA has given US federal agencies until 24 November 2026 to remediate. Its required action is to apply mitigations in line with the vendor's instructions, following BOD 26-04 guidance on risk-based security updates and the Forensics Triage Requirements, and to discontinue use of the product if no mitigation is available. CISA also reminds asset owners to assess each system's internet exposure. There is no indication in the available data that this vulnerability has been used in ransomware campaigns, so treat that specific claim with caution.

What to do today

Confirm whether you use it. Ask your IT team or hosting provider whether Openwave Webtop Media Transcoder is present anywhere in the mail stack, and which version. Anything below 1.1.22.0 falls inside the published affected range.
Apply the vendor's fix or mitigation. The NVD entry does not state which release resolves the issue, so follow the advisory from Openwave and the third-party advisories referenced (the public security advisory on GitHub and the JVN entry JVNVU93403064) rather than guessing a version number.
Look for signs of intrusion. Review transcoding activity and conversion logs for document types outside the administrator-defined allow list, and check for unusual authenticated sessions or accounts bypassing the standard Webmail interface.
Reduce what is exposed to the internet. Restrict administrative and webmail access to known networks where possible, enforce multi-factor authentication, and review which accounts genuinely need access to the transcoding service.
Document the decision. If you cannot patch immediately, record the compensating controls in place — this matters for GDPR accountability and for any future incident review.

How a cybersecurity team such as ALMC's can help

For a small business with a lean IT function, the hard part is rarely reading the advisory — it is knowing what is actually running on your servers and what is reachable from the internet. ALMC's cybersecurity work starts there: security audits and pentesting to map real exposure, server hardening to close the gaps that make a medium-severity flaw useful to an attacker, and monitoring with incident response so that unusual conversion activity or a suspicious login does not sit unnoticed for weeks.

For the platforms most Spanish SMEs actually run — WordPress, PrestaShop and Joomla — the same discipline applies through maintenance and timely security patching, plus cleanup and recovery when a site has already been hacked. The lesson from CVE-2026-111793 is a familiar one: a vulnerability only becomes dangerous when it is left unpatched, exposed and unwatched. Keeping an inventory of versions, a patching routine and someone reviewing the logs turns a KEV entry from a crisis into a ticket.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.