Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited — Webtop Media Transcoder
- Added to KEV catalog
- 10 November 2026
- Federal remediation due date
- 24 November 2026
- Weakness classification (CWE)
- CWE-669
AI Breakdown
What it is
Openwave Webtop Media Transcoder fails to properly enforce administrator restrictions on which file types can be converted. This flaw allows an authenticated user who bypasses the standard Webmail interface to process and convert unintended document types.
Why it matters
Although specific ransomware campaign use is currently unknown, this flaw is cataloged by CISA due to active exploitation evidence. Allowing users to process unauthorized file types undermines expected security boundaries and exposes systems to abuse. Organizations must prioritize addressing this flaw before the federal deadline of November 24, 2026.
Recommended action
Apply vendor-supplied mitigations immediately according to official instructions and CISA BOD 26-04 guidelines. IT teams must evaluate the internet exposure of affected assets and follow required forensic triage procedures. If appropriate mitigations are unavailable, discontinue use of the product.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md ; https://jvn.jp/en/vu/JVNVU93403064/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111793
NVD Technical Description
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services