Openwave Messaging Limited
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Openwave Messaging Limited Webtop Media Transcoder, treat it as High.
Briefing
- Organisations using Openwave Messaging Limited Webtop Media Transcoder should review and apply mitigations in line with vendor guidance and CISA BOD 26-04 requirements.
- Leaders should assess the internet exposure of affected assets and ensure compliance with patching guidelines for cloud services or consider discontinuing use if mitigations are unavailable.
Questions to ask IT
- Do we run Openwave Messaging Limited Webtop Media Transcoder, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 17 Nov?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-111793- 4.3 · MediumExploitable over the network with a low-privilege account, and no one has to click or open anything. Low impact on availability.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Listed: attacks using it have been seen (on the catalogue since )
- ~0.3% estimated chance of attack in 30 days
- Not linked from the CVE record
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Openwave Messaging Limited Webtop Media Transcoder has a vulnerability that may allow an authenticated user to process unintended document types when bypassing the Webmail experience.
- The vulnerability, CVE-2026-111793, is reported as exploited in the wild according to the US known-exploited catalogue.
Products and services involved
- Openwave Messaging Limited Webtop Media Transcoder88% match confidence · CVE-2026-111793
Pulse
Last change 26m ago · Next recheck 11 Nov 2026, 03:32 UK time
- Story10 Nov 2026, 21:32 UK time · 26m ago
Linked reporting from CISA (official authority).
Read source (CISA Known Exploited Vulnerabilities)
1 entry so far. The timeline chart appears once this story has more history.
Sources
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-111793
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-111793 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-111793 has an estimated ~0.3% chance of attack in 30 days (20th percentile) as of 2026-11-10 — probability signal, not confirmed exploitation