Openwave Messaging says Webtop Media Transcoder before 1.1.22.0 does not enforce administrator-defined file-type restrictions, so an authenticated user who bypasses the Webmail experience can convert unintended document types, and JPCERT/CC’s JVN advisory says an attacker who uploads a crafted file in specific steps may obtain sensitive information [1][2]. CISA added CVE-2026-111793 to the Known Exploited Vulnerabilities catalog on November 10 without publishing attack details [3]. Operators of Webtop Media Transcoder should upgrade to 1.1.22.0 or later, and Openwave recommends moving to the latest supported Media Server 2.0 release [1].
Openwave Webtop Media Transcoder ignores admin file-type limits; CVE-2026-111793 added to KEV
1 min read
- Disclosed
- Oct 7, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- 0.6%, higher than 51% of CVEs
- Exploitation and patch status
- ExploitedKEVPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Openwave Messaging Webtop Media Transcoder
What to do nowOur advice
Operators of Webtop Media Transcoder should upgrade to 1.1.22.0 or later, and Openwave recommends moving to the latest supported Media Server 2.0 release [1]
Affected scope
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
- 1Upgrade Webtop Media Transcoder patch[1]
Upgrade to 1.1.22.0 or later, or to the latest supported Media Server 2.0 release as Openwave advises.
References
Official / primary2
- [1]
“Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.”
- [3]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.