CVE-2026-111793
Medium4.3CISA KEV — exploited in the wildOpenwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerabilityname from CISA KEV
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
- CVSS
- 4.3v3.1
- EPSS (exploit probability)
- 0.3%20th pct
- CISA KEV
- Listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-11-10 | 0.3% | 20.0% |
| 2026-11-09 | 0.3% | 19.9% |
| 2026-11-08 | 0.2% | 15.3% |
| 2026-11-07 | 0.2% | 15.3% |
| 2026-11-06 | 0.2% | 15.3% |
| 2026-11-05 | 0.2% | 15.3% |
| 2026-11-04 | 0.2% | 15.3% |
| 2026-11-03 | 0.2% | 15.3% |
| 2026-11-02 | 0.2% | 15.3% |
| 2026-11-01 | 0.2% | 15.3% |
| 2026-10-31 | 0.2% | 15.3% |
| 2026-10-30 | 0.2% | 15.3% |
| 2026-10-29 | 0.2% | 15.2% |
| 2026-10-28 | 0.2% | 15.2% |
| 2026-10-27 | 0.2% | 15.1% |
| 2026-10-26 | 0.2% | 15.1% |
| 2026-10-25 | 0.2% | 15.1% |
| 2026-10-24 | 0.2% | 14.4% |
| 2026-10-23 | 0.2% | 14.4% |
| 2026-10-22 | 0.2% | 14.4% |
| 2026-10-21 | 0.2% | 14.4% |
| 2026-10-20 | 0.2% | 14.3% |
| 2026-10-19 | 0.2% | 14.3% |
| 2026-10-18 | 0.2% | 14.2% |
| 2026-10-17 | 0.2% | 14.2% |
CISA KEV entrycatalogue 2026.11.10
- Date added
- 2026-11-10
- Federal due date
- 2026-11-24
- Known ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-11-11 16:43 UTC). The due date applies to US federal agencies under BOD 22-01.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Learn