CVE-2026-111793: listed in the CISA KEV catalog

CVE-2026-111793 · CVSS 4.3 MEDIUM · EPSS 1% · KEV 2026-11-10 · patch available

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

Is CVE-2026-111793 exploited?

• Listed in the CISA KEV catalog on 2026-11-10.
• Federal remediation due 2026-11-24.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Openwave Messaging (Ireland) Limited · Webtop Media Transcoder · >= 0, < 1.1.22.0

Is there a patch?

Yes. Update to one of these or later:

From Openwave Messaging (Ireland) Limited's CVE record

What PlainSec published about CVE-2026-111793

• BroadWorks and Webtop flaws expose messaging systems (2026-11-11)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-11-12.