CISA Flags Exploited Openwave Webtop Media Transcoder Restriction Bypass
Tech GuruQuick Answer
Inventory Webtop MediaTranscoder, follow Openwave’s supported Media Server 2.0 upgrade guidance, and verify administrator file-type restrictions against authorized conversion workflows.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product and component versions, exposure, administrative controls, service owners and maintenance dependencies. Check installed component versions and authenticated access paths outside Webmail; do not treat the historical fix date as the current advisory date. Upgrade to the latest supported Media Server 2.0 release as the vendor directs, confirming that the MediaTranscoder fix is included. Verify component versions, test permitted and prohibited document conversion with safe samples, and review unexpected conversion activity.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Openwave Webtop MediaTranscoder |
|---|---|
| Advisory | CAN-2026-2032674 / CISA-KEV-CVE-2026-111793 |
| CVE | CVE-2026-111793 |
| CISA KEV addition and catalog release | November 10, 2026 (KEV addition); catalog released at 2026-11-10T19:03:29.837500Z. |
| Authority revision date | Underlying vendor advisory released 2026-10-07. The new event is CISA KEV inclusion. |
| Affected versions | Webtop MediaTranscoder before 1.1.22.0. An authenticated user bypassing the Webmail experience can convert document types prohibited by administrator settings. |
| Fixed version | MediaTranscoder 1.1.22.0 fixes the issue; vendor remediation is the latest supported Media Server 2.0 release |
| CVSS base score | 4.3 (vendor CVSS v3.1 base score) |
| CVSS severity | Medium |
| Exploitation status | CISA confirms exploitation through its November 10, 2026 KEV addition. Ransomware campaign use is Unknown.; no exploitation claim is inferred. |
What Changed
CISA added the file-type restriction bypass to KEV. The vendor disclosed the advisory on October 7, 2026 and identifies an older fixed version released in December 2021.
What To Validate Now
- Inventory. Record product and component versions, exposure, administrative controls, service owners and maintenance dependencies.
- Establish applicability. Check installed component versions and authenticated access paths outside Webmail; do not treat the historical fix date as the current advisory date.
- Remediate. Upgrade to the latest supported Media Server 2.0 release as the vendor directs, confirming that the MediaTranscoder fix is included.
- Validate. Verify component versions, test permitted and prohibited document conversion with safe samples, and review unexpected conversion activity.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CISA lists November 24, 2026 as the due date and forensic triage No. Preserve relevant access and conversion logs and validate application compatibility before rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
