JPCERT/CC has warned that attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder, a flaw whose fix has been available since December 2021. The agency said the developer reports that attacks using the flaw have been observed, which implies the targeted servers never installed the update.
What CVE-2026-111793 Does Inside the Media Transcoder
The Media Transcoder ignores file type restrictions that an administrator defines. An authenticated user can send unexpected document types straight to the transcoder, bypassing the controls meant to filter them, and a crafted file may expose sensitive information. The flaw is classified as CWE-669.
Openwave rates the issue CVSS 4.3, a medium severity. The score reflects the authenticated-user requirement and the information-disclosure impact rather than code execution, but the exploitation reports show attackers find value in it regardless.
Mismatch Between the Low Score and Observed Attacks
CISA’s CVE-record assessment from October 19 listed the exploitation status as “none.” The JPCERT/CC report on November 9 contradicts that assessment on the strength of the developer’s observation of attacks. The gap shows how quickly exploitation status can change relative to published assessments, and how a medium score can understate real-world risk for a component that processes attachments on behalf of many users.
A Four-Year-Old Fix Still Unapplied
The fixed version, 1.1.22.0, was released on December 6, 2021. The attacks therefore target servers running software nearly five years out of date. JPCERT/CC’s notice affects Openwave Webtop Media Transcoder before that version.
Openwave’s guidance covers two options. Customers can upgrade to 1.1.22.0 or later, or move to a supported Media Server 2.0 release.
Webmail Platforms Used by Service Providers at Risk
Webtop is used in webmail platforms operated by service providers, where the transcoder converts attachments for display. A flaw that lets an authenticated user push unexpected file types through that conversion step creates a path to documents and data the platform did not intend to expose. For a provider hosting many mailboxes, a single compromised or malicious account could become a way to reach information outside its own mailbox.
What the Observed Attacks Leave Unanswered
The advisory material does not name the attackers, say how many servers were hit or describe what was taken. It also does not date the first observed attack. JPCERT/CC’s involvement suggests at least some affected deployments are in Japan, though the notice, as reported, does not state the geographic scope.
The case follows a recurring pattern in vulnerability reporting: a long-patched flaw, rated modestly, becomes an active target because some operators leave older versions in service. For administrators of such systems, the exploitation signal changes the priority of the 1.1.22.0 upgrade from routine maintenance to a response to observed attacks. The 2021 release date also means the window between fix and exploitation spans years, not days.
Timeline Gap Between the 2021 Fix and the 2026 Attack Reports
The sequence of dates in the case is unusual. Openwave released the fixed version on December 6, 2021. CISA’s assessment in the CVE record on October 19 still recorded no exploitation, and JPCERT/CC’s report of observed attacks followed on November 9. A vulnerability with a patch in circulation for years was therefore classed as unexploited until very recently.
The attacks the developer observed hit servers that never upgraded, which makes the reported exposure a matter of installed base rather than of a newly found weakness. The service providers that run Webtop as a webmail platform are the operators the report implicitly concerns, because the Media Transcoder component sits in the attachment path of that product.
The fix guidance offers a second route for customers who do not wish to stay on the older line: moving to a supported Media Server 2.0 release instead of upgrading the existing transcoder.
