pwned.coffeeOrder ticket · today's special · 10 Nov 2026

🔥 On the fly · exploited in the wildUS federal deadline 2026-11-24Americano · 183°CmediumOn hold · status unknown

Openwave Webtop Media Transcoder: file type restrictions not enforced

Openwave Webtop Media Transcoder

Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Added to CISA KEV on 2026-11-10 (federal deadline 2026-11-24).

Binds US federal agencies under CISA BOD 26-04.

Do this now

It is being exploited: check the advisory for a fix and restrict access to Webtop Media Transcoder meanwhile.

First seen: 10 Nov 2026
Last update: 11 Nov 2026, 09:17 UTC
Versions per the CVE record from mitre, not the vendor: 1.1.22.0
Identifiers: CVE-2026-111793
CVSS: 4.3
KEV deadline: 2026-11-24
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Openwave Webtop Media Transcoder: file type restrictions not enforced
Severity: medium, exploited in the wild. Patch status: fix status unknown.
Affected: Openwave Webtop Media Transcoder
Versions per the CVE record from mitre, not the vendor: 1.1.22.0
Ids: CVE-2026-111793

Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Added to CISA KEV on 2026-11-10 (federal deadline 2026-11-24).

## Steps
1. Search the repo, its CI and infra config for Openwave Webtop Media Transcoder. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from mitre, not the vendor: Webtop Media Transcoder: 1.1.22.0. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Webtop Media Transcoder | per the CVE record from mitre, not the vendor | 1.1.22.0 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-111793") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md https://jvn.jp/en/vu/JVNVU93403064/ https://nvd.nist.gov/vuln/detail/CVE-2026-111793 https://www.securityweek.com/threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities/
https://pwned.coffee/i/openwave-messaging-limited-webtop-media-transcoder-incor-cve-2026-111793

Timeline

11 Nov 2026, 09:17 UTC
Reported by securityweek.com: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
10 Nov 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2026-111793 added to CISA KEV on 2026-11-10, federal deadline 2026-11-24.” source
Checked by hand “Openwave Messaging advisory CAN-2026-2032674: "Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted." The stored name joined the company name and the product.” source
By release line, per the CVE record from mitre, not the vendor: Product Affected Version named Source
Webtop Media Transcoder before 1.1.22.0 1.1.22.0 CVE record (CNA) per the CVE record from mitre, not the vendor checked 12 Nov
Score: CVSS 4.3 (medium). CVSS 3.1 4.3 (CNA mitre) for CVE-2026-111793
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
Webtop Media Transcoder	before 1.1.22.0	1.1.22.0	CVE record (CNA) per the CVE record from mitre, not the vendor checked 12 Nov

Sources: KEV ✓ CVE record ✓ Vendor –

Sources

Follow on X

Totalone coffee