CISA adds exploited Openwave flaw CVE-2026-111793

CISA added CVE-2026-111793 to its known exploited catalog on November 10. The flaw is in Openwave Messaging's Webtop Media Transcoder, and the catalog due date is November 24.

The vendor says file-type limits are not applied. Openwave's advisory says Webtop Media Transcoder does not apply the file-type limits an administrator sets for conversion. An authenticated user who steps outside the webmail flow may convert document types the limits were meant to block. The vendor scores the issue 4.3, medium, on CVSS v3.1. MITRE's vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. NVD has not published its own base score.

The listed fix shipped in December 2021. Openwave says versions before 1.1.22.0 are affected. It says 1.1.22.0, released on December 6, 2021, is the first fixed build. The remediation line tells customers to move to the latest Media Server 2.0 release the vendor supports. The advisory identifier is CAN-2026-2032674, with a disclosure date of October 7, 2026.

Japan's vulnerability note says the developer has seen attacks. JVN, published November 9, says the developer states that attacks using this flaw have been observed. JVN says an authenticated attacker who uploads a crafted file through specific steps may obtain sensitive information. CISA's catalog entry uses the name incorrect resource transfer between spheres, CWE-669. CISA lists ransomware use as unknown.

CISA's required action points back to the vendor. Agencies are told to apply the vendor's mitigations, follow CISA's risk-based update directive, and meet its forensics triage guidance. If no mitigation is available, CISA says to follow that directive for cloud services or stop using the product. The catalog notes cite the Openwave advisory and the JVN page.