Threat actors are exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information.
Openwave Messaging provides email and messaging platforms, including webmail, to communication service providers. Webtop Media Transcoder handles document conversion, and Openwave’s advisory ties it to the company’s webmail.
The Webtop Media Transcoder bug, tracked as CVE-2026-111793, exists because administrator-defined file-type restrictions are not enforced, allowing users to convert unintended file types.
“This may allow an authenticated user to process and convert unintended document types if bypassing the webmail experience,” Openwave Messaging explains in an advisory.
Webtop Media Transcoder version 1.1.22.0, which rolled out in December 2021, contains patches. The security defect was disclosed on October 7, and a CVE record was published on October 16.
Japan JVN flagged the weakness as exploited on November 9, warning that an authenticated attacker could exploit it to upload a specially crafted file and obtain sensitive information.
The Cisco BroadWorks vulnerability, tracked as CVE-2026-20320, was disclosed on August 19 as an out-of-band blind XML external entity injection that could be exploited remotely, without authentication, to read sensitive configuration information.
“This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service,” Cisco notes in its advisory.
Patches for the issue were included in version RI.2026.07 of BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform.
On November 8, Malbear Labs warned that a Chinese-speaking threat actor has been exploiting the vulnerability in a broad campaign that relied on an autonomous AI intrusion harness to target a European telecommunications provider and its customers.
At least 13 organizations using the telecoms provider’s services may have been targeted. The campaign focused on asset enumeration, credential theft, and subscriber billing and device records harvesting.
The US cybersecurity agency CISA added the Openwave and Cisco security defects to its Known Exploited Vulnerabilities (KEV) catalog on November 10, urging federal agencies to patch both by November 24.
Additionally, CISA expanded the KEV list with two Barracuda flaws, an Outlook zero-day patched on Tuesday, and a Chrome bug patched on November 9 as a zero-day.
Related: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Related: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
Related: Plex2Shell Exploited Against QNAP NAS Users
Related: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
