Executive Summary
CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-10. The flaw is an incorrect resource transfer between spheres weakness in the Openwave Messaging Limited Webtop Media Transcoder.
Inclusion in KEV means CISA has evidence of active exploitation in the wild.
Vulnerability Details
| Attribute | Value |
|---|---|
| CVE | CVE-2026-111793 |
| Vendor / Product | Openwave Messaging Limited / Webtop Media Transcoder |
| Weakness | Incorrect resource transfer between spheres |
| Authentication | Required (authenticated user) |
| Status | CISA KEV listed |
An authenticated user who bypasses the normal Webmail experience can cause the transcoder to process and convert document types it was not intended to handle. Which document types are affected, the CVSS score, and the fixed versions were not available in the feed data we reviewed. Check the vendor advisory and CISA's KEV entry for those details.
Recommended Actions
- Identify any Openwave Webtop / messaging deployments in your environment.
- Apply the vendor's fix or mitigation per the CISA KEV entry. Federal agencies are bound by the KEV due date, and other organizations should treat it as a patch-priority signal.
- Restrict direct access to the transcoder endpoint so it is reachable only through the Webmail front end.
- Review transcoder and webmail logs for conversions of unusual document types or direct calls that skip the Webmail flow.
- Enforce MFA on mailbox accounts, since exploitation needs a valid login.
References
- NVD: CVE-2026-111793
- CISA Known Exploited Vulnerabilities Catalog