Openwave Webtop Media Transcoder Flaw CVE-2026-111793 Exploited and Added to CISA KEV — Authenticated Webmail Users Can Pull Sensitive Data, Fixed in 1.1.22.0
CISA added CVE-2026-111793, an exploited flaw in Openwave's webmail attachment-preview transcoder that lets authenticated users obtain sensitive information, to KEV with a 24 November federal deadline; version 1.1.22.0 fixes it.
Overview
CISA has added CVE-2026-111793, a flaw in Openwave Messaging's Webtop Media Transcoder, to its Known Exploited Vulnerabilities (KEV) catalog. The vendor says it has observed attacks. The transcoder is the component behind webmail attachment preview and conversion in Openwave-based messaging platforms, which telecoms and ISPs commonly use for consumer mailboxes. It is fixed in version 1.1.22.0. U.S. federal civilian agencies must remediate by 24 November 2026.
The ratings on this flaw disagree widely. NVD's CVSS score is 4.3 (Medium), while Japan's JVN advisory, based on JPCERT/CC coordination, labels it Critical. Confirmed exploitation, plus a component that sits in front of millions of mailboxes, makes it more urgent than its base score suggests.
The Vulnerability
- Type: Incorrect Resource Transfer Between Spheres (CWE-669). One vulnerability database classifies it instead as unrestricted file upload (CWE-434).
- Affected: Webtop Media Transcoder versions before 1.1.22.0.
- Requirements: An authenticated user, such as any mailbox holder or an attacker using stolen webmail credentials.
- Impact: Per the advisory, an authenticated attacker who uploads a specially crafted file "by following specific steps" may obtain sensitive information. NVD describes the root cause as the transcoder failing to enforce administrator-configured file-type limits, so users can convert document types they should not be able to.
- Fix: Version 1.1.22.0 is the first fixed build. The vendor directs customers to the latest supported Media Server 2.0 release.
No technical write-up or public exploit details from the vendor are available, and the exploitation technique hasn't been described.
Timeline
- October 2026: Vendor security advisory (vendor reference CAN-2026-2032674) and CVE published.
- 9 November 2026: JVN publishes advisory JVNVU#93403064, stating that the developer has observed attacks.
- 10 November 2026: CISA adds CVE-2026-111793 to KEV alongside five other flaws.
- 24 November 2026: KEV remediation due date for U.S. federal civilian agencies.
Tradecraft
The attacks have not been publicly attributed. The flaw needs a valid login, so expect it to be chained with credential stuffing or phishing of webmail accounts. That is a common pattern against large ISP mail platforms, where reused consumer passwords are plentiful. Once logged in, an attacker uploads a crafted attachment and drives the preview/conversion feature to get file types processed that policy should block, which can expose information from the transcoding back end. Because many providers run shared transcoder back-ends, one weak account could expose data beyond that user's mailbox.
Detection
- Inventory every transcoder instance, including shared back-ends, standby and DR nodes, and confirm the running build.
- Review webmail authentication, access and transcoder logs for the whole period an affected build was in service. Look for conversion requests for unusual or disallowed file types, repeated preview failures followed by success, and single accounts converting many attachments.
- Correlate transcoder activity with suspicious logins (new geographies, credential-stuffing bursts, impossible travel).
- Preserve logs now, before rotation removes evidence from the exposure window.
# Example: surface conversion requests for non-standard extensions in transcoder logs
# (adjust path and log format to your deployment)
grep -Ei "convert|transcod" /var/log/openwave/transcoder*.log \
| grep -Eiv "\.(pdf|docx?|xlsx?|pptx?|jpe?g|png|gif|txt)\b" | tail -n 200Recommended Actions
- Upgrade to 1.1.22.0 or later, ideally the latest supported Media Server 2.0 release, and confirm the upgrade path with the vendor for legacy or managed installations.
- Verify the build on each node after rollout, then test attachment preview and conversion with a standard test account.
- If you can't patch, ask the vendor which mitigations it supports. Per KEV guidance, stop using the component if no mitigation is available, for example by temporarily disabling attachment preview.
- Strengthen webmail authentication: rate-limit logins, detect credential stuffing, and offer or enforce MFA.
- Hosted customers (ISPs and businesses using a provider's Openwave platform) should ask the provider whether the affected component and build are in use and get written confirmation of the fix.
Analyst Assessment
On paper this is a modest information-disclosure bug that needs authentication. In practice, vendor-confirmed exploitation and the KEV listing show attackers have found it worth using, probably against telecom and ISP mail platforms with huge user bases and plenty of reusable credentials. Without public details, defenders should assume the worst-case reading of the JVN "Critical" label until they have patched and reviewed their logs. Severity is rated High, given active exploitation, the exposed position of webmail infrastructure, and the conflicting official ratings.
