CISA adds Openwave Webtop Media Transcoder flaw to KEV (CVE-2026-111793)
Original title: CISA KEV: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability — Openwave Messaging Limited Webtop Media Transcoder (CVE-2026-111793)
An authenticated user who bypasses Webmail can process unintended document types; federal due date is November 24.
CISA added CVE-2026-111793, an incorrect resource transfer between spheres flaw in Openwave Messaging Limited Webtop Media Transcoder, to the Known Exploited Vulnerabilities catalog. An authenticated user who bypasses the Webmail experience may process and convert unintended document types. CISA set a November 24 due date and says known ransomware use is unknown. Agencies must apply vendor mitigations under BOD 26-04 or stop using the product.
Unconfirmed: CISA says known ransomware campaign use is unknown.
- Required action is vendor mitigations plus CISA forensics triage requirements.
- Stakeholders must assess each asset’s internet exposure against BOD 26-04.
- Cloud services must follow applicable BOD 26-04 guidance.
- No affected or fixed version is stated.
Impact: authenticated processing of unintended document types
| Product | Affected |
|---|---|
| Openwave Messaging Limited Webtop Media Transcoder | — |
- 1.Apply vendor mitigations and follow CISA BOD 26-04 guidance.
- 2.Discontinue product use if mitigations are unavailable.
- 3.Meet the November 24 due date after assessing internet exposure.
- CVEs
- CVE-2026-111793
- Vendors
- Openwave Messaging Limited
- Products
- Webtop Media Transcoder
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111793 | File-type restriction bypass in Openwave Webtop Media Transcoder | 4.3 | <1% | KEV | KEV |
From the original article
1 min read at cisa.govOpenwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.