# Openwave Webtop Media Transcoder: exploited file conversion flaw

Canonical: https://www.oktsec.com/radar/openwave-webtop-media-transcoder-cve-2026-111793
Publisher: Oktsec
Language: en
Published: 2026-11-13T01:26:23Z
Updated: 2026-11-13T01:26:23Z
Record reviewed: 2026-11-13T01:26:23Z
Latest evidence check: 2026-11-13T01:26:23Z
Disclosed: 2026-10-07

JVN reports that the developer has observed attacks against Webtop Media Transcoder, and CISA lists the CVE in KEV. Exploitation requires authentication and a crafted file conversion sequence.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Act now
- Rationale: CISA lists this exact CVE in KEV and JVN relays the developer’s observation of attacks. Authentication is required; the vendor identifies a corrected version and recommends a supported release.
- Evidence: Attacks confirmed
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Account access required
- Vendor: Openwave
- Products: Webtop Media Transcoder
- CVEs: CVE-2026-111793

## Technical overview

The vendor describes a bypass of administrator restrictions on which document types may be converted when an authenticated user bypasses the Webmail experience. JVN describes possible sensitive information disclosure through a crafted upload sequence. Neither cited notice establishes unauthenticated remote code execution.

JVN published its warning on November 9 and reports the developer’s observation of attacks. CISA added the CVE to KEV on November 10. These dates describe the advisories and exploitation warning, not a newly released patch: Openwave’s notice dates the first corrected component to December 2021 and recommends its current supported Media Server 2.0 release.

Oktsec recommends confirming the deployed component and upgrade path with the vendor, then reviewing earlier conversion activity rather than treating the software update as evidence that no information was exposed.

## Recommended response

Identify Webtop Media Transcoder versions below 1.1.22.0 and arrange the vendor’s supported Media Server upgrade. Review conversion activity and investigate possible information exposure.

Relevant to: Operators of Openwave Webtop and Media Server document conversion services.

## CVE attribution

- CVE-2026-111793: Openwave — Webtop Media Transcoder. [Source](https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md)

## Affected systems and fixes

### Webtop Media Transcoder

Affected: Versions earlier than 1.1.22.0

Fixed release / action: 1.1.22.0; vendor recommends the latest supported Media Server 2.0 release

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.10
Checked: 2026-11-13T02:21:36.147Z

### [CVE-2026-111793](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111793)

- Added: 2026-11-10
- Ransomware use: Not confirmed by CISA
- Federal due date: 2026-11-24
- Federal forensic triage: No

Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-111793](https://api.first.org/data/v1/epss?cve=CVE-2026-111793): 0.64% probability of observed exploitation in the next 30 days; percentile 51.07%; score date 2026-11-12.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z.

## Response checklist

1. **Find the conversion service and its version** — Inventory Webtop Media Transcoder instances and confirm the installed component version. The affected range is earlier than 1.1.22.0; do not infer safety from the Webmail interface version alone.
2. **Arrange the supported vendor correction** — Openwave identifies fixes from Media Transcoder 1.1.22.0 and recommends the latest supported Media Server 2.0 release. Confirm the applicable package and upgrade path with the vendor.
3. **Review conversion and account activity** — Oktsec recommends preserving logs, checking unusual document conversion requests and investigating sensitive data access by the involved accounts. An update prevents the vulnerable behavior but does not reverse earlier disclosure.

## Relevance to AI environments

If automated document workflows use this converter, Oktsec recommends reviewing accepted file types and the data accessible to the conversion service.

## Sources

- [CAN-2026-2032674: affected versions and remediation](https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md) — Openwave; Vendor notice; checked 2026-11-13T01:26:23Z
- [JVNVU93403064: observed attacks and information exposure](https://jvn.jp/en/vu/JVNVU93403064/) — JPCERT/CC and IPA; Government advisory; checked 2026-11-13T01:26:23Z
- [CISA KEV: exact CVE record](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-13T01:26:23Z

## Editorial record

- 2026-11-13T01:26:23Z: Added verified product scope, exploitation evidence and the vendor’s correction guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/openwave-webtop-media-transcoder-cve-2026-111793) · [Build a response plan](https://www.oktsec.com/radar/openwave-webtop-media-transcoder-cve-2026-111793#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=openwave-webtop-media-transcoder-cve-2026-111793&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=openwave-webtop-media-transcoder-cve-2026-111793&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.