# CVE-2026-111793 — Openwave Messaging (Ireland) Limited Webtop Media Transcoder **CISA KEV** > As of 2026-11-11, CVE-2026-111793 is a MEDIUM-severity vulnerability in Openwave Messaging (Ireland) Limited Webtop Media Transcoder, CVSS v3.1 4.3, EPSS 0.2% (19.9th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-11-10), with a US federal remediation deadline of 2026-11-24. Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-111793, most recently “Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV”. **Last updated:** 2026-11-11 ## What is CVE-2026-111793? Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. The record classifies CVE-2026-111793 under weakness class [CWE-669](https://intel.threadlinqs.com/cwe/CWE-669). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 26 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 4.3 — MEDIUM (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L`) - **EPSS (FIRST):** 0.2% probability of exploitation in the next 30 days, higher than 19.9% of all scored CVEs - **CISA KEV:** Listed since 2026-11-10, federal remediation deadline 2026-11-24 - **Threadlinqs priority:** 9/10 — CISA KEV-listed, which Threadlinqs floors at 9 - **Published:** 2026-10-16 ## Is CVE-2026-111793 being exploited? CISA added CVE-2026-111793 to the Known Exploited Vulnerabilities catalog on 2026-11-10, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-11-24 under BOD 22-01. It currently carries a trending score of 43 in the Threadlinqs vulnerability feed. ## Affected products and versions - **Openwave Messaging (Ireland) Limited**: Webtop Media Transcoder ## How to fix CVE-2026-111793 Because CVE-2026-111793 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-11-24. No vendor patch reference has been recorded for CVE-2026-111793 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2026-111793 1 tracked threat in the Threadlinqs corpus references CVE-2026-111793, either in the campaign’s CVE list or as an indicator on the campaign record. - [Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-5734) — HIGH · 2026-11-11 ## Sources Enriched from CVE.org, NVD, FIRST EPSS, CISA KEV, GitHub Security Advisories. This product uses the NVD API but is not endorsed or certified by the NVD. **Other references** - [openwave.ai](https://openwave.ai/) - [github.com](https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md) Canonical: https://intel.threadlinqs.com/cve/CVE-2026-111793 Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Sign up free (Blue): https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds (https://threadlinqs.com/tl-creds); MCP access for AI agents needs Purple: https://intel.threadlinqs.com/mcp