SockAnalyst
← All playbooks
MediumExploited vuln · 2026-11-12

Openwave Webtop Media Transcoder CVE-2026-111793: file-type restriction bypass exploited, on CISA KEV (due Nov 24)

SockAnalyst · Security+ certified analyst.

What happened

Openwave Messaging's advisory CAN-2026-2032674 (disclosed October 7, 2026) says Webtop Media Transcoder, the document-conversion service behind its carrier webmail, does not enforce administrator-defined file-type restrictions, so an authenticated user who bypasses the Webmail interface can process and convert unintended document types. Openwave rates it CVSS 3.1 4.3 Medium. On November 9 Japan's JVN (JVNVU#93403064) labeled it Critical, said a crafted upload may expose sensitive information, and said the developer has observed attacks. CISA added it to the KEV catalog on November 10 with a November 24 federal deadline. The fix, version 1.1.22.0, has existed since December 2021, so exploited systems are long-unpatched installs. No public details on attackers, victims or method.

Who's affected

Communication service providers and other operators running Openwave Webtop Media Transcoder before 1.1.22.0, particularly where authenticated users can reach the transcoder directly instead of only through Webmail.

✅ Fix / patch

  • Upgrade Webtop Media Transcoder to 1.1.22.0 or later; Openwave tells customers to move to the latest supported Media Server 2.0 release. Contact Openwave for patch details, as JVN instructs.
  • Until patched, make sure the transcoder is reachable only from the Webmail tier, not directly by users or the internet.
  • Review transcoder and webmail logs for authenticated sessions submitting conversion jobs directly to the transcoder, and for document types your policy blocks.

🔎 Quick hunt check

No IOCs have been published by Openwave, JVN or CISA. Hunt for conversion requests that reach the transcoder from anything other than your Webmail servers, and for file types your administrators restricted. Set the transcoder host and webmail server lists in the queries to match your environment.

MITRE ATT&CK: T1078, T1213

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=proxy OR index=web OR index=firewall) dest IN ("<transcoder_host>") NOT src_ip IN ("<webmail_server_ip_1>","<webmail_server_ip_2>")
| eval ext=lower(mvindex(split(coalesce(file_name, uri_path), "."), -1))
| stats count min(_time) as first_seen max(_time) as last_seen values(ext) as file_types values(uri_path) as paths dc(uri_path) as distinct_paths by src_ip, user, http_method
| sort - count
// Openwave Webtop Media Transcoder CVE-2026-111793: direct-to-transcoder requests that bypass the Webmail tier (replace placeholders)
let TranscoderHosts = dynamic(["<transcoder_host>"]);
let WebmailServers = dynamic(["<webmail_server_ip_1>", "<webmail_server_ip_2>"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationHostName in~ (TranscoderHosts) or DestinationIP in (TranscoderHosts)
| where SourceIP !in (WebmailServers)
| extend FileType = tolower(extract(@"\.([A-Za-z0-9]{1,6})(\?|$)", 1, RequestURL))
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), FileTypes=make_set(FileType, 25), Urls=make_set(RequestURL, 25) by SourceIP, SourceUserName, RequestMethod
| order by Requests desc
// Openwave Webtop Media Transcoder CVE-2026-111793: non-Webmail sources hitting the transcoder (replace placeholders)

See all hunt queries →

⏱ CISA deadline

CVE-2026-111793CVSS 4.3 Medium (v3.1, CNA)
--
Federal due 2026-11-24 · CISA KEV catalog

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →