Openwave Webtop Media Transcoder: file type restriction bypass (CVE-2026-111793) exploited in the wild, fixed in 1.1.22.0
Published 11/11/2026 16:19
Timeline
5 events over 2 d 15 h
- 09/11/2026First report+1 d
- 10/11/2026CorroboratedCISA Known Exploited Vulnerabilities+0 min
- 10/11/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 10/11/2026ExploitedCISA Known Exploited Vulnerabilities+1 d 15 h
- 11/11/2026 16:19Published on WatchtowerPro CISO
In short
Openwave Webtop Media Transcoder does not enforce the file type restrictions set by administrators. A logged-in user who bypasses Webmail can convert document types that were meant to be blocked. CISA lists the flaw as exploited since 10/11/2026, so update to 1.1.22.0 or later.
How bad is it
Medium. An attacker with a valid login who can reach the transcoder directly, bypassing Webmail, can convert document types the administrator meant to block, with a limited effect on availability.
Being exploited - on CISA's known-exploited list since 10/11/2026.
Severity score
CVSS 3.1 from NVD, from mitre.org, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Slow it down or interrupt it
Type: access control bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Openwave Webtop Media Transcoder on Linux, all versions before 1.1.22.0 (vendor listed in the CVE record as Openwave Messaging (Ireland) Limited).
What to do now
- Upgrade Webtop Media Transcoder to version 1.1.22.0 or later. The CVE record lists versions before 1.1.22.0 as affected, but does not itself call 1.1.22.0 a fix, so confirm this in the vendor advisory (GISOpenwave/security-advisories-public on GitHub, file CAN-2026-2032674.md).
- The vendor has published no interim measure that could be read. Any workaround only reduces exposure and does not make the server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Openwave Messaging Limited Webtop Media Transcoder, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Openwave Messaging Limited Webtop Media Transcoder - Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability Vendor · Known exploited (VulnCheck KEV): Openwave Messaging (Ireland) Limited Webtop Media Transcoder - Incorrect Resource Transfer Between Spheres Research · CVE Record: CVE-2026-111793 Research