Openwave Webtop Media Transcoder: an old document converter flaw is now exploited

What happened

Openwave Messaging supplies mass-market email platforms to internet service providers and telecoms carriers, including the Webtop webmail. One of its components is Media Transcoder, which, going by the vendor's description, converts documents. Administrators can configure which file types it may convert and which it must refuse.

On 7 October 2026 the vendor published advisory CAN-2026-2032674 for a flaw later assigned CVE-2026-111793: in versions before 1.1.22.0, the transcoder does not enforce those file type restrictions. NVD published the record on 16 October.

On 9 November 2026 Japan's coordination centre JPCERT/CC published JVNVU#93403064, which states that the vendor has observed attacks exploiting the flaw. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, giving federal agencies until 24 November 2026 to act. NVD completed its analysis on 11 November.

One detail matters a lot: according to the vendor's advisory, the fixed version 1.1.22.0 was released on 6 December 2021. This is not a new bug but newly confirmed exploitation of deployments that have not been updated for a long time.

How serious is it

The ratings contradict each other. The CVSS vector assumes only a low availability impact and no confidentiality impact at all. JVN, by contrast, says an authenticated attacker who uploads a specially crafted file by following specific steps may be able to obtain sensitive information. When deciding how fast to patch, confirmed exploitation counts for more than the 4.3.

Technical details

Administrators can block conversion of selected document types. According to the vendor, however, that check lives in the webmail interface, not in the transcoder itself. An authenticated user who bypasses the webmail and talks to the transcoder directly can have it convert file types that should have been refused.

Why that matters: document converters parse complex formats, and type restrictions are often there precisely to keep out the formats most likely to leak data or cause trouble during processing. Neither the vendor, NVD nor JVN has said which file types attackers are using, what information they can obtain or how the attacks unfolded. We will add details under Updates once they are published. As a matter of principle we do not describe how to exploit the flaw.

Who is affected

All Webtop Media Transcoder versions earlier than 1.1.22.0 are vulnerable (on Linux, per NVD). As remediation, the vendor recommends moving to the latest supported Media Server 2.0 release.

The email providers and carriers that run Webtop are the ones who need to act; their mailbox users have nothing to patch. Because the attack requires a login, the biggest risk is in large deployments with many users – and therefore many stolen mailbox passwords in circulation.

How to tell if you were compromised

The vendor, CISA and JVN have not published indicators of compromise. Based on the description of the flaw, we suggest the following (our recommendations, not the vendor's):

• Check the version of the transcoder on every server. Treat anything below 1.1.22.0 as exposed.
• Review the transcoder logs for requests that did not come from your webmail servers and for conversions of file types you have blocked.
• Look for suspicious accounts: logins from unusual addresses and accounts calling the transcoder far more often than the rest.

You can pull addresses out of exported logs into a clean list with our IOC extractor, which runs entirely in your browser.

What to do

1. Upgrade the transcoder to at least 1.1.22.0 and, as the vendor recommends, preferably to the latest supported Media Server 2.0 release.
2. Restrict network access to the transcoder to the webmail servers that need it. The flaw depends on users bypassing the webmail interface. Our subnet calculator helps you draft the firewall rules.
3. Check your logs as described above over as long a period as you can, since vulnerable versions may have been running for years.
4. Review user accounts: force password resets for accounts with suspicious activity and offer two-step verification.
5. US federal agencies must follow CISA's direction (BOD 26-04 and the forensic triage requirements) by 24 November 2026.

Timeline

Updates

• 12 November 2026 – first version of this article.