Openwave Webtop Media Transcoder Vulnerability CVE-2026-111793 Exploited in the Wild

TL;DR

JPCERT/CC has warned that attackers are exploiting CVE-2026-111793, an Openwave Webtop vulnerability in the Webtop Media Transcoder. According to the advisory, “The developer states that attacks exploiting the vulnerability have been observed.” The flaw affects all versions before 1.1.22.0.

Webtop Media Transcoder ignores the file type limits that administrators set. As a result, a logged-in user can convert document types the admin meant to block. Upgrade to version 1.1.22.0 or later, or move to a supported Media Server 2.0 release.

Why It Matters

Webtop is Openwave’s webmail platform, used by service providers. The transcoder converts attachments so users can preview them in the browser. JPCERT/CC says that if an attacker “uploads a specially crafted file by following specific steps, sensitive information may be obtained.”

Notably, the fix is old. Openwave released version 1.1.22.0 on December 6, 2021, yet attacks are now hitting servers that never upgraded.

Low score, real attacks

Openwave rates the flaw only CVSS 4.3, or medium. Moreover, CISA’s October 19 assessment in the CVE record listed exploitation as “none.” The new JPCERT/CC note changes that picture, so admins should not rely on the score alone.

How the Attack Works

Openwave says the transcoder “does not enforce administrator-defined file type restrictions.” Normally, the webmail interface limits which files reach the converter. However, an authenticated user who goes around “the Webmail experience” can send unexpected document types straight to it. JPCERT/CC classifies the bug as an incorrect resource transfer between spheres (CWE-669).

Affected Versions

• Webtop Media Transcoder versions prior to 1.1.22.0

Patch and Mitigation

• Upgrade Webtop Media Transcoder to 1.1.22.0 or later.
• Openwave recommends moving to “the latest Media Server 2.0 supported release.”
• Contact Openwave for patch details, as JPCERT/CC advises.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.