CVE-2026-111793
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
What is it?
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Official description from NVD.
What happened
CISA added CVE-2026-111793, an improper resource transfer vulnerability in Openwave Messaging Limited Webtop Media Transcoder, to the KEV catalog. Authenticated users can process and convert unintended document types by bypassing the Webmail interface. Federal patch deadline is November 24, 2026.
From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- HighCISA adds Openwave Webtop Media Transcoder flawNov 10, 2026