Openwave Webtop Media Transcoder CVE-2026-111793: JVN says attacks seen, advisory silent, fix dated 2021

The vendor's advisory dates the fix to 2021, 1,766 days before its own disclosure date

Openwave Messaging (Ireland) Ltd's public advisory CAN-2026-2032674 for the Webtop Media Transcoder says the fixed version is "From Version 1.1.22.0 , released on 6 December 2021". The only date the advisory prints besides that is a disclosure date of 2026-10-07. The gap between the two is 1,766 days, which is 4 years, 10 months and 1 day (derived). The advisory rates the flaw "CVSS v3.1: 4.3 Medium". On 10 November 2026 CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities (KEV) catalogue with a due date of 24 November, 14 days later (derived). All of this is as read between 06:47 and 06:56 UTC on Wednesday 11 November 2026.

What that does not establish: how the flaw is being used. The statement that attacks have been seen is not on the vendor's advisory page, which has no word on attacks or exploitation. It is on the Japanese vulnerability notes site JVN, which says "The developer states that attacks exploiting the vulnerability have been observed." CISA's catalogue entry and the CISA-ADP data in the CVE record say the flaw is listed and that exploitation is "active". No page read names an actor, a date of first use, a victim count, a type of account or the "specific steps" JVN refers to.

No page read states what Openwave sells, so no selling interest is stated for the vendor. The advisory names a Webmail experience and a Media Server 2.0 release and nothing more about the company's products. The vendor's own site was tried and answered this client with a not found page, so it was not read.

Who says attacks have been seen, and who only prints a score

The table lists every place read that speaks to exploitation or severity, in the order a reader meets them. The vendor's advisory prints a score and a fix and is silent on attacks. JVN carries the vendor's statement, second hand, and says the vendor reported the flaw to JPCERT/CC "to notify users of its solution through JVN". CISA's signals are its own: the catalogue entry and the exploitation value in its CVE data. The score comes from the CVE record, where MITRE is the publisher.

Zoom

Only one of those pages carries the vendor's statement that attacks have been seen, and that page is a government and industry notes site relaying it. This briefing therefore says "JVN says the developer states", not "Openwave says". Whether the same statement was made to CISA, or whether CISA relied on other evidence, is not stated: the catalogue entry gives no source for its exploitation finding.

A 4.3 that CISA calls actively exploited: what the score covers and what it does not

The score is the vendor's to the extent that its advisory prints the same number: "CVSS v3.1: 4.3 Medium". The vector is only in the CVE record, whose publisher is MITRE (assigner short name "mitre", generated by a request form). NVD lists the score with source cve@mitre.org and type Secondary. Who worked the metrics out is therefore not stated; the number and the label agree across the vendor page and the record. Derived: the vector's exploitability sub score is 2.8, the impact sub score is 1.4 and the base score rounds up to 4.3 under the CVSS 3.1 formula, matching the sub scores NVD prints.

Read as written, the vector says the attack comes over the network (AV:N), is low complexity, needs low privileges (PR:L, which fits "an authenticated user"), needs no user interaction, and gives no loss of confidentiality or integrity but a low loss of availability (C:N, I:N, A:L). JVN's impact line says something different: an authenticated attacker who uploads a specially crafted file "by following specific steps" may obtain "sensitive information". Information disclosure is a confidentiality impact, which the vector scores as none. The CVE description, for its part, says only that a user may be able to "process and convert unintended document types". Neither the description nor the advisory mentions uploads or the disclosure of data.

CISA's data says Technical Impact is partial. CISA's directive BOD 26-04 defines partial control as one of two cases, the first being that "The exploit gives the threat actor limited control over, or information exposure about, the behavior of the software that contains the vulnerability", and adds that "A denial-of-service attack is a form of limited control over the behavior of the vulnerable component." Partial therefore fits an availability only reading and an information exposure reading alike. That is this site's inference; no page says which CISA meant.

The word that does the work here is "Medium". A reader triaging by severity label would put a 4.3 in the next patch cycle. The same CVE record carries CISA's exploitation value of active, the vendor's statement via JVN, and a catalogue listing with a 14 day due date. BOD 26-04 does not rank by CVSS at all: its page says the urgency of remediation depends on asset exposure, catalogue status, whether an adversary can automate every step, and technical impact. A score measures a flaw's characteristics on paper; whether it is being used is a separate fact, and here the two disagree about how worried to be.

The clock: a fix dated December 2021, a CVE in October 2026, a due date in November

The advisory's "Fixed Versions" line gives 1.1.22.0 and a release date of 6 December 2021, a Monday. Its "Disclosure Date" is 2026-10-07, a Wednesday. The CVE record shows the identifier reserved and published at 18:28 UTC on Friday 16 October, under half a second apart (derived), 9 days after that disclosure date (derived). JVN published its note on 2026/11/09 (year, month, day, so Monday 9 November), 24 days after the record (derived), and CISA listed the flaw the next day, Tuesday 10 November. The record was last updated at 04:55 UTC on 11 November, the same time the CISA-ADP section carries.

Zoom

The advisory page as saved carries no commit or publication time, so its own date of publication is not known; this briefing uses the "Disclosure Date" line it prints and no other. The affected range reads "Versions prior to 1.1.22.0" on the advisory and on JVN. The CVE record writes the same range as version "0" with lessThan "1.1.22.0", where "0" is the start of a range and not a version number, so the three sources agree on the range as printed. NVD's configuration ends the range before 1.1.22.0 too.

What does follow from the dates, if both the advisory and JVN are right, is an uncomfortable fact: the fix is almost five years old, so any system that was attacked ran a release older than 1.1.22.0 (inference), or the advisory's fix date and versions mean something other than they appear to. The pages do not say which, and do not say whether a 1.1.x release is still supported: the advisory's remediation line points customers to "the latest Media Server 2.0 supported release", and does not say how that relates to the Webtop Media Transcoder versions.

The due date is 14 days after listing. In the catalogue as read, 162 entries were added from 11 June 2026, the month BOD 26-04 was issued, and all 162 carry its wording (derived). Of them, 103 have forensicTriage Yes and every one of those is due in 3 days. Of the other 59, which have forensicTriage No, 23 are due in 3 days and 36 in 14 days; this entry is one of the 36 (all derived). The directive's table of timelines is a figure on CISA's page, which this site could not read as text, so it does not say which conditions give 14 days. The directive says "& forensic triage" means remediation within the timeline of three days plus a triage of the asset; this entry's flag is No.

What the sources establish, and what they do not

Two of those gaps matter more than the rest. The flaw is described as the transcoder failing to enforce a restriction an administrator set, yet no page says where that setting lives or what its default is, so a reader cannot tell whether a patched system enforces it by default or only after a change. And "authenticated" is a precondition no source defines: the advisory, the record and CISA use the word and none says whether it means any mailbox user or something narrower.

Where the sources differ

These differences are left as differences. (1) The attack statement is on JVN and not on the vendor advisory. (2) The vendor's name is "Openwave Messaging Limited" in CISA's catalogue (vendorProject and the vulnerability name) and "Openwave Messaging (Ireland) Limited" in the CVE record and on JVN; the advisory's title says "Openwave Messaging (Ireland) Ltd". The product is "Webtop Media Transcoder" in the record, JVN and KEV, and "Webtop MediaTranscoder" under Affected Products on the advisory. No page says whether these are one legal entity. (3) The vector scores confidentiality as none and availability as low, while JVN's impact line says sensitive information may be obtained. (4) The record and NVD describe the flaw as unenforced file type restrictions; JVN adds an upload of a "specially crafted file" and "specific steps"; the advisory has neither. (5) JVN heads the page with the word Critical and prints no score, while the advisory and record say 4.3 Medium. (6) Remediation differs: the advisory says to upgrade to the latest Media Server 2.0 supported release; JVN says to apply the patch per the developer's information and to contact the developer; CISA's entry says to apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.

What to do, in order

The first three items are the vendor's, JVN's and CISA's own advice, attributed. The rest are this site's suggestions, and each says so. The primaries describe no architecture beyond a "Webmail experience", so any advice about network placement is inference.

What was read, and what was not

Read in full, as saved by this site's lead and re-checked between 06:47 and 06:56 UTC on Wednesday 11 November 2026: the Openwave advisory (GitHub's page, read from its page data and rendered text), the JVN note, the CVE record, the NVD record, CISA's catalogue (version 2026.11.10, released 19:03 UTC on 10 November), and CISA's BOD 26-04 and its implementation guidance. No secondary source was used for any figure. The directive's remediation table is an image on CISA's page and was not read. Openwave's own website answered this client with a not found page on three addresses and was not read; no access check was bypassed. JVN's links to the JPCERT/CC addendum and analysis pages were not followed, because the JVN page prints them as plain text and not as addresses.

Technical details

Openwave, JVN, the CVE record, NVD and CISA print no indicator of compromise, no hash, no address, no request or file format, no configuration key or endpoint name, no log line, no detection query and no exploit or payload for this flaw. This briefing therefore holds none. What is printed is the identifiers, the score, the versions, the fix and CISA's fields, copied below. Each block is a reference for a defender, not an attack aid.

The vendor advisory in full. This is the whole of the page, apart from the page chrome. A defender copies the advisory id into the ticket and notes what is missing: no workaround, no setting name, no log guidance.

# Openwave Messaging (Ireland) Ltd - Public Security Advisory

## Identifier
CAN-2026-2032674

## Summary
Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.
This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

## Affected Products
Webtop MediaTranscoder

## Severity
CVSS v3.1: 4.3 Medium

## Affected Versions
Versions prior to 1.1.22.0

## Fixed Versions
From Version 1.1.22.0 , released on 6 December 2021

## Remediation
Customers should upgrade to the latest Media Server 2.0 supported release

## References
CAN-2026-2032674

## Disclosure Date
2026-10-07

The JVN note. The only place the developer's attack statement is printed. A defender reads the impact line and the solution lines, and notes that the page prints no score.

JVNVU#93403064: Webtop Media Transcoder vulnerable to incorrect resource transfer between spheres
Published:2026/11/09  Last Updated:2026/11/09
Critical

Products Affected
Webtop Media Transcoder versions prior to 1.1.22.0

Description
Incorrect Resource Transfer Between Spheres (CWE-669)
CVE-2026-111793
The developer states that attacks exploiting the vulnerability have been observed.

Impact
If an authenticated attacker uploads a specially crafted file by following specific steps, sensitive information may be obtained.

Solution
Apply the Patch
Apply the patch according to the information provided by the developer.
Contact the developer for the details.

The CVE record's version range and score. The range as the record encodes it, and the CVSS 3.1 block as MITRE's record prints it. A scanner that matches on version strings should read the range as 0 up to but not including 1.1.22.0.

"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"Webtop Media Transcoder","vendor":"Openwave Messaging (Ireland) Limited","versions":[{"lessThan":"1.1.22.0","status":"affected","version":"0","versionType":"custom"}]}]
"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}

Who published the record. The assigner, the generator and the three timestamps, copied from the record. The CISA-ADP section shares the final timestamp.

"assignerShortName":"mitre"
"x_generator":{"engine":"CVE-Request-form 0.0.1"}
"dateReserved":"2026-10-16T18:28:09.751Z","datePublished":"2026-10-16T18:28:10.170Z","dateUpdated":"2026-11-11T04:55:54.627Z"

NVD's view. The score as NVD lists it, with its source and type, and the configuration range. The layout is this site's; the values are NVD's.

"source": "cve@mitre.org",
"type": "Secondary",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"criteria": "cpe:2.3:a:openwave:webtop_media_transcoder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.22.0"

CISA's entry. The fields CISA prints, including the triage flag and the required action. A federal civilian agency treats the due date as an obligation; others can use it as a priority signal.

"cveID": "CVE-2026-111793",
"vendorProject": "Openwave Messaging Limited",
"product": "Webtop Media Transcoder",
"vulnerabilityName": "Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability",
"dateAdded": "2026-11-10",
"shortDescription": "Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.",
"requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"dueDate": "2026-11-24",
"knownRansomwareCampaignUse": "Unknown",
"forensicTriage": "No",
"cwes": ["CWE-669"]

CISA-ADP data in the CVE record. The decision values CISA attached. They are CISA's assessment, dated 10 November, and carry no exploitation detail.

"timestamp":"2026-11-10T00:00:00+00:00","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"

CISA's evidence first guidance, two lines. From the implementation guidance, as general steps for entries that require forensic triage, which this entry does not. A responder who suspects exposure reads them before the upgrade, because patching can destroy evidence.

Do not alter or remediate systems prior to evidence/artifact collection when possible.
Establish a dedicated out-of-band communication channel that does not rely on potentially compromised infrastructure.

The question Openwave leaves open

Openwave's advisory says the fix has existed since December 2021 and says nothing about attacks, while the vendor's statement that attacks have been seen reached the public through JVN and CISA's listing. If attacks are real, which customers were running a release older than 1.1.22.0 five years after the fix, and why does the vendor's own advisory not say so?

Key facts