JPCERT/CC reports in-the-wild exploitation of CVE-2026-111793 in Openwave Webtop Media Transcoder, patched since 2021
JPCERT/CC has warned that attackers are exploiting CVE-2026-111793, a flaw in the Openwave Webtop Media Transcoder, the component of Openwave's service-provider webmail platform that converts attachments for in-browser preview. The advisory states the developer has observed attacks exploiting the vulnerability. All versions prior to 1.1.22.0 are affected; the transcoder ignores administrator-defined file type restrictions, so an authenticated user who bypasses the webmail interface can submit unintended document types and, by uploading a specially crafted file following specific steps, obtain sensitive information. Operational urgency is tempered by the prerequisites: the attacker must be an authenticated user and must interact with the transcoder outside the normal webmail flow, which is why Openwave rates the issue only CVSS 4.3 (medium, CVSSv3). The fix is not new — version 1.1.22.0 was released on 6 December 2021 — so exploitation is hitting servers that never upgraded in nearly five years.
Entenda a falha
A vulnerabilidade
CVE-2026-111793 is a flaw in Openwave Webtop Media Transcoder, the component of Openwave's service-provider webmail platform that converts attachments for browser preview. The transcoder does not enforce the file type restrictions set by administrators (CWE-669). An attacker needs a valid account and must talk to the transcoder directly instead of through the webmail interface. By uploading a specially crafted file, they may obtain sensitive information. All versions before 1.1.22.0 are affected, and 1.1.22.0 (released 6 December 2021) fixes it. Openwave rates it CVSS 4.3 (medium), but the developer says attacks have been observed.
Como funciona
Normally a user attaches a document in the webmail interface, and the interface limits which file types are allowed to reach the transcoder. The transcoder then converts the file so it can be previewed in the browser. If an authenticated user bypasses the webmail front end and submits files straight to the transcoder, that filtering never happens. The transcoder accepts document types the administrator meant to block and processes them. A specially crafted file sent this way may lead to disclosure of sensitive information. The articles do not describe the exact steps or what data is exposed.
Por que é vulnerável
The restriction on file types is enforced only by the webmail front end, not by the transcoder itself. The transcoder trusts that whatever reaches it has already been filtered, so direct submissions skip the administrator's policy. JPCERT/CC classifies this as CWE-669, incorrect resource transfer between spheres. The articles say the fix is in version 1.1.22.0 but do not detail what it changes, and they do not explain why the issue went unnoticed.
Como foi descoberta
The articles do not say who found the flaw or how. JPCERT/CC's advisory quotes the developer as stating that attacks exploiting the vulnerability have been observed. The story says the CVE record was published on 16 October 2026 with Rapid7 as CNA, and that CISA's 19 October assessment in the record listed exploitation as none, which the JPCERT/CC note now supersedes. No indicators of compromise or attribution have been published.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 01:15.
Detalhes técnicos
The weakness is classified by JPCERT/CC as CWE-669 (Incorrect Resource Transfer Between Spheres). Normally the webmail front end restricts which files reach the converter; direct, protocol-level submission to the transcoder bypasses that policy enforcement. The CVE record was published on 16 October 2026 and the entry is credited to Rapid7 as CNA (vulners.com, vuldb.com). The article notes that CISA's 19 October assessment in the CVE record listed exploitation as "none", a status the JPCERT/CC note now supersedes. No indicators of compromise, exploit details or attribution have been published.
Remediação
Upgrade Webtop Media Transcoder to 1.1.22.0 or later, or migrate to the latest supported Media Server 2.0 release as Openwave recommends. JPCERT/CC advises contacting Openwave for patch details. Operators should also review transcoder access paths and logs for direct, non-webmail submissions of unexpected document types.
Linha do tempo
-
JPCERT/CC reports in-the-wild exploitation of CVE-2026-111793 in Openwave Webtop Media Transcoder, patched since 2021
ler a análise desta fonte ocultar
JPCERT/CC has warned that attackers are exploiting CVE-2026-111793, a flaw in the Openwave Webtop Media Transcoder, the component of Openwave's service-provider webmail platform that converts attachments for in-browser preview. The advisory states the developer has observed attacks exploiting the vulnerability. All versions prior to 1.1.22.0 are affected; the transcoder ignores administrator-defined file type restrictions, so an authenticated user who bypasses the webmail interface can submit unintended document types and, by uploading a specially crafted file following specific steps, obtain sensitive information. Operational urgency is tempered by the prerequisites: the attacker must be an authenticated user and must interact with the transcoder outside the normal webmail flow, which is why Openwave rates the issue only CVSS 4.3 (medium, CVSSv3). The fix is not new — version 1.1.22.0 was released on 6 December 2021 — so exploitation is hitting servers that never upgraded in nearly five years.
Technical Details
The weakness is classified by JPCERT/CC as CWE-669 (Incorrect Resource Transfer Between Spheres). Normally the webmail front end restricts which files reach the converter; direct, protocol-level submission to the transcoder bypasses that policy enforcement. The CVE record was published on 16 October 2026 and the entry is credited to Rapid7 as CNA (vulners.com, vuldb.com). The article notes that CISA's 19 October assessment in the CVE record listed exploitation as "none", a status the JPCERT/CC note now supersedes. No indicators of compromise, exploit details or attribution have been published.
Remediation
Upgrade Webtop Media Transcoder to 1.1.22.0 or later, or migrate to the latest supported Media Server 2.0 release as Openwave recommends. JPCERT/CC advises contacting Openwave for patch details. Operators should also review transcoder access paths and logs for direct, non-webmail submissions of unexpected document types.