CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities catalog on 10 November 2026 as 'Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability', saying an authenticated user may process and convert unintended document types if bypassing the Webmail experience; the US federal due date is 24 November 2026 and known ransomware campaign use is Unknown. (source: CISA KEV)

Openwave Messaging (Ireland) advisory CAN-2026-2032674 (disclosure date 7 October 2026) says Webtop Media Transcoder does not enforce administrator-defined file type restrictions on the file types to be converted.

It rates the flaw CVSS 3.1 4.3 Medium, lists versions prior to 1.1.22.0 as affected, says 1.1.22.0 (released 6 December 2021) is fixed, and tells customers to upgrade to the latest supported Media Server 2.0 release. (source: Openwave advisory)

JPCERT/CC's JVNVU#93403064 (published 9 November 2026) says an authenticated attacker who uploads a specially crafted file by following specific steps may obtain sensitive information, and that the developer states attacks exploiting the vulnerability have been observed. (source: JVN)