A Chinese-speaking threat actor has been exploiting two critical vulnerabilities, one in Openwave Webtop Media Transcoder and the other in Cisco BroadWorks, to access sensitive information from at least 13 organizations that rely on a European telecommunications provider. The exploitation of these vulnerabilities highlights the ongoing risks posed by unpatched software flaws and underscores the importance of timely patching.
Openwave Messaging provides email and messaging platforms to communication service providers, including webmail services that handle document conversion. However, its Webtop Media Transcoder feature contains a bug (CVE-2026-111793) that allows users to bypass file-type restrictions, enabling them to convert unintended file types. This vulnerability was disclosed on October 7 and patched in version 1.1.22.0 of the software, which was released in December 2021.
The Webtop Media Transcoder bug can be exploited by an authenticated user who uploads a specially crafted file, potentially allowing access to sensitive information. Japan’s JVN flagged the weakness as being actively exploited on November 9. Openwave Messaging has advised that this vulnerability is related to its webmail service and has provided patches for affected users.
Meanwhile, Cisco’s BroadWorks platform contains a separate vulnerability (CVE-2026-20320) that allows an attacker to read sensitive configuration information without authentication. This out-of-band blind XML external entity injection bug was disclosed on August 19 as part of version RI.2026.07 of the BroadWorks Application Delivery Platform. Patches for this issue were included in the release, but it appears that some organizations have yet to apply them.
Malbear Labs warned on November 8 that a Chinese-speaking threat actor has been exploiting the Cisco vulnerability in a broad campaign targeting European telecommunications providers and their customers. The campaign focused on asset enumeration, credential theft, and subscriber billing and device records harvesting. At least 13 organizations may be affected by this exploitation.
The US cybersecurity agency CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on November 10, urging federal agencies to patch them by November 24. This emphasizes the need for timely patching of software flaws to prevent exploitation by threat actors.
Source: SecurityWeek — 2026-11-11