What happened
CWE-669 incorrect resource transfer between spheres. CISA added CVE-2026-111793 to KEV on 2026-11-10 with confirmed in-the-wild exploitation.
Why it matters
Not AI-specific; included per the KEV coverage rule.
Attack vector
An authenticated user can process and convert unintended document types by bypassing the Webmail experience.
Affected systems
Openwave Webtop Media Transcoder
Mitigation
Apply the vendor mitigation (GISOpenwave security advisory / JVN JVNVU93403064); CISA federal due date 2026-11-24.