CISA adds exploited Openwave Messaging flaw to KEV catalogue

CISA added CVE-2026-111793 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. The vulnerability affects Openwave Messaging Limited Webtop Media Transcoder and could let an authenticated user process and convert unintended document types by bypassing the Webmail experience.

The flaw is an incorrect resource transfer between spheres. The available description identifies an authenticated user and a bypass of the Webmail experience as conditions for processing unintended document types; it does not provide further details about the attack vector or other impacts. The vulnerability has a CVSS score of 4.3, rated MEDIUM. Patch status is unknown, and no patch or advisory URL was provided.

CISA’s KEV listing indicates that exploitation has been confirmed. The available data does not confirm whether the vulnerability has been used in ransomware campaigns. Federal Civilian Executive Branch (FCEB) agencies must meet CISA’s remediation deadline of 24 November 2026.

CISA requires agencies to apply mitigations in accordance with vendor instructions, comply with applicable BOD 26-04 guidance and CISA’s Forensics Triage Requirements, and follow the relevant BOD 26-04 guidance for cloud services. If mitigations are unavailable, agencies must discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidelines.

FCEB agencies are directly affected by the federal requirement; all organisations should review their exposure and consult the vendor’s security advisory.

For full details, see the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-111793) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).