Attackers are exploiting a flaw in Openwave Webtop Media Transcoder that has had a fix available since December 2021. Japan's JPCERT/CC warned on 9 November 2026 that attacks using CVE-2026-111793 have been observed, and the US agency CISA added the flaw to its Known Exploited Vulnerabilities catalogue the next day, on 10 November.

The flaw, rated CVSS 4.3, sits in the component that converts documents and media attachments so they can be displayed inside the Webtop webmail interface. It does not enforce the file-type restrictions that an administrator defines. An authenticated user can send unexpected document types straight to the transcoder, bypassing the controls meant to filter them, and a crafted file may expose sensitive information. It is classified as CWE-669, an incorrect transfer of resources between security boundaries.

A fix from 2021, still unapplied

The fixed version, 1.1.22.0, was released on 6 December 2021, and the flaw affects Webtop Media Transcoder versions before that release. The attacks therefore target servers running software nearly five years out of date. Openwave's guidance gives customers two options: upgrade to version 1.1.22.0 or later, or move to a supported Media Server 2.0 release.

The timeline is what makes this case unusual. CISA's assessment in the CVE record on 19 October still listed the exploitation status as none. The JPCERT/CC report on 9 November contradicted that assessment, on the strength of the developer's observation of attacks. A vulnerability with a patch in circulation for years was therefore classed as unexploited until very recently, and the reported exposure is a matter of installed base rather than of a newly found weakness.

Why a medium score still matters

A CVSS score of 4.3 reflects the authenticated-user requirement and the information-disclosure impact rather than code execution, but the exploitation reports show attackers find value in the flaw regardless. Webtop is used in webmail platforms operated by service providers, where the transcoder converts attachments for display. A flaw that lets an authenticated user push unexpected file types through that conversion step creates a path to documents and data the platform did not intend to expose.

For a provider hosting many mailboxes, a single compromised or malicious account could become a way to reach information outside its own mailbox. The gap between the published score and the observed attacks shows how a medium rating can understate the real-world risk for a component that processes attachments on behalf of many users.

What the reports leave unanswered

The advisory material does not name the attackers, say how many servers were hit or describe what was taken. It also does not date the first observed attack. JPCERT/CC's involvement suggests at least some affected deployments are in Japan, though the notice, as reported, does not state the geographic scope.

For administrators running Webtop, the exploitation signal changes the priority of the 1.1.22.0 upgrade from routine maintenance to a response to observed attacks. CISA has set 24 November 2026 as the remediation deadline for US federal agencies, and all organisations running the transcoder should treat the same date as their target. The case follows a recurring pattern: a long-patched flaw, rated modestly, becomes an active target because some operators leave older versions in service. Read the CISA notice adding CVE-2026-111793 to the exploited list and the Daily Security Review report on the JPCERT/CC warning.