CISAAnalysisCISA adds Openwave Messaging file restriction bypass flaw to KEV catalog after active attacks
What happened.CISA added an actively exploited document handling flaw in Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog.
Why it matters.Enterprise messaging platforms rely on media transcoders to convert attachments into browser-safe formats for webmail users. When direct API submissions bypass administrative file filters, attackers force transcoders to process forbidden formats and expose sensitive message metadata. Messaging engineers must deploy Openwave version 1.1.22.0 immediately and isolate transcoder ports.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-111793 with a 4.3 CVSS score, the defect represents an incorrect resource transfer flaw during file conversion operations.
- Restriction bypass: Attackers bypass webmail interface filters and upload crafted document structures directly to the media transcoder service component.
- Information disclosure: The transcoder processes disallowed document types, exposing internal server memory buffers and message metadata during conversion cycles.
- Exploitation status: International coordination authorities reported active in-the-wild exploitation campaigns targeting enterprise webmail environments.
- Remediation releases: Openwave Messaging released software updates in version 1.1.22.0, while CISA established a federal remediation deadline under BOD 26-04.