{"id":"EM-20261110-R92M","url":"https://cyber.eventmonitor.net/incident/EM-20261110-R92M/cve-2026-111793-openwave-messaging-limited-webtop-media-transcoder-incorrect/","type":"cve","title":"Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability","subtitle":"CVE-2026-111793","subject":"CVE-2026-111793","status":"Confirmed","severity":"high","affected":["Openwave Messaging Limited Webtop Media Transcoder"],"headline":"0 hours from first report to confirmed exploitation.","born":"2026-11-10T12:00:00.000Z","firstSignal":"2026-11-10T12:00:00.000Z","lastSignal":"2026-11-10T12:00:00.000Z","updated":"2026-11-10T20:23:48.430Z","revision":2,"life":[{"status":"Born","at":"2026-11-10T12:00:00.000Z","why":"second independent source: C2 CISA Cybersecurity Advisories"},{"status":"Developing","at":"2026-11-10T12:00:00.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-11-10T12:00:00.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-11-10T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-11-10T12:00:00.000Z","what":"Born: second source, C2 CISA Cybersecurity Advisories. Page EM-20261110-R92M created."},{"at":"2026-11-10T12:00:00.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"}],"stages":[{"name":"Disclosed","at":"2026-10-16T19:17:05.680Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-16T19:17:05.680Z","detail":"CVSS 4.3 · EPSS 0.3%"},{"name":"Exploited","at":"2026-11-10T12:00:00.000Z","detail":"C1 CISA KEV, fix by 2026-11-24"},{"name":"Advisories","at":"2026-11-10T12:00:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-11-24, then 14 quiet days"}],"signals":[{"at":"2026-11-10T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-111793 added to KEV: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability","text":"Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-11-10T12:00:00.000Z","source":"C2","sourceName":"CISA Cybersecurity Advisories","role":"Government","severity":3,"title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","text":"CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder…","url":"https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-16T19:17:05.680","score":4.3,"severity":"MEDIUM","desc":"Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.","product":"","seen":1794342228430},"kev":{"added":"2026-11-10","due":"2026-11-24","ransomware":"Unknown","vendor":"Openwave Messaging Limited","product":"Webtop Media Transcoder","name":"Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability"},"epss":{"epss":0.00274,"pct":0.19971,"at":1794342228430},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}