Search: CVE-2026-111793

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

Two vulnerabilities, CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks, have been exploited by threat actors to leak sensitive information including configuration data. The Openwave flaw allows authenticated users to bypass file-type restrictions to convert unintended document types, potentially exposing sensitive data. The Cisco BroadWorks vulnerability is a remote, unauthenticated XML external entity injection that permits reading sensitive configuration information. Both vulnerabilities have been patched by their respective vendors. The U.S. CISA has added these flaws to its Known Exploited Vulnerabilities catalog and urges patching by November 24, 2026. Exploitation campaigns have targeted telecommunications providers and their customers, focusing on asset enumeration, credential theft, and subscriber data harvesting.