Openwave Webtop Media Transcoder Flaw CVE-2026-111793 Exploited and Added to CISA KEV — Authenticated Webmail Users Can Pull Sensitive Data, Fixed in 1.1.22.0

High · 2026-11-11 · By H.A

Openwave Webtop Media Transcoder Flaw CVE-2026-111793 Exploited and Added to CISA KEV — Authenticated Webmail Users Can Pull Sensitive Data, Fixed in 1.1.22.0

CISA added CVE-2026-111793, an exploited flaw in Openwave's webmail attachment-preview transcoder that lets authenticated users obtain sensitive information, to KEV with a 24 November federal deadline; version 1.1.22.0 fixes it.

Overview

CISA has added CVE-2026-111793, a flaw in Openwave Messaging's Webtop Media Transcoder, to its Known Exploited Vulnerabilities (KEV) catalog. The vendor says it has observed attacks. The transcoder is the component behind webmail attachment preview and conversion in Openwave-based messaging platforms, which telecoms and ISPs commonly use for consumer mailboxes. It is fixed in version 1.1.22.0. U.S. federal civilian agencies must remediate by 24 November 2026.

The ratings on this flaw disagree widely. NVD's CVSS score is 4.3 (Medium), while Japan's JVN advisory, based on JPCERT/CC coordination, labels it Critical. Confirmed exploitation, plus a component that sits in front of millions of mailboxes, makes it more urgent than its base score suggests.

The Vulnerability

No technical write-up or public exploit details from the vendor are available, and the exploitation technique hasn't been described.

Timeline

Tradecraft

The attacks have not been publicly attributed. The flaw needs a valid login, so expect it to be chained with credential stuffing or phishing of webmail accounts. That is a common pattern against large ISP mail platforms, where reused consumer passwords are plentiful. Once logged in, an attacker uploads a crafted attachment and drives the preview/conversion feature to get file types processed that policy should block, which can expose information from the transcoding back end. Because many providers run shared transcoder back-ends, one weak account could expose data beyond that user's mailbox.

Detection

# Example: surface conversion requests for non-standard extensions in transcoder logs
# (adjust path and log format to your deployment)
grep -Ei "convert|transcod" /var/log/openwave/transcoder*.log \
  | grep -Eiv "\.(pdf|docx?|xlsx?|pptx?|jpe?g|png|gif|txt)\b" | tail -n 200

Recommended Actions

Analyst Assessment

On paper this is a modest information-disclosure bug that needs authentication. In practice, vendor-confirmed exploitation and the KEV listing show attackers have found it worth using, probably against telecom and ISP mail platforms with huge user bases and plenty of reusable credentials. Without public details, defenders should assume the worst-case reading of the JVN "Critical" label until they have patched and reviewed their logs. Severity is rated High, given active exploitation, the exposed position of webmail infrastructure, and the conflicting official ratings.

REEF SENTINEL