Recent reports have highlighted that cybercriminals are actively exploiting vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to gain unauthorized access to sensitive data. These security flaws pose significant risks to communication service providers using these platforms.
Openwave Vulnerability Details
Openwave Messaging, known for its email and messaging services, has identified a critical flaw in its Webtop Media Transcoder. This component is responsible for document conversion within the company’s webmail systems. The vulnerability, identified as CVE-2026-111793, stems from inadequate enforcement of file-type restrictions. This oversight allows authenticated users to convert files that should be restricted.
According to Openwave’s advisory, this flaw can enable a user to bypass certain security measures and process unauthorized document types. The issue was addressed in version 1.1.22.0 of the Webtop Media Transcoder, released in December 2021, and was publicly disclosed on October 7, with a CVE entry on October 16. Japan’s JVN has reported active exploitation of this vulnerability, warning that attackers could upload manipulated files to extract sensitive information.
Cisco BroadWorks Security Issue
Another serious vulnerability, CVE-2026-20320, affects Cisco BroadWorks, a widely used telecommunications platform. This flaw, revealed on August 19, concerns a remote, unauthenticated XML external entity injection. It allows attackers to retrieve sensitive configuration data by sending crafted XML messages to the Open Client Interface – Provisioning (OCI-P) service.
Cisco has addressed this issue in version RI.2026.07 of its BroadWorks platform. However, Malbear Labs recently reported a campaign by a Chinese-speaking threat actor leveraging this exploit against a European telecom provider. This campaign aimed to gather information on assets, steal credentials, and harvest subscriber data.
Urgent Call for Patch Implementation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reacted by adding these vulnerabilities to its Known Exploited Vulnerabilities catalog as of November 10. Federal agencies have been advised to apply patches by November 24 to mitigate potential risks.
In addition to the Openwave and Cisco issues, CISA has expanded the catalog with other critical vulnerabilities, including flaws in Barracuda, a patched Outlook zero-day, and a Chrome vulnerability addressed on November 9.
Given the ongoing exploitation of these vulnerabilities, organizations using Openwave and Cisco products are urged to implement the recommended patches promptly to safeguard their systems and data.
