EUVD-2026-90370Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated admin account
-
DeliveryAccess administrative reporting feature
-
ExploitInject stored SQL payload
-
ExecutionBackend executes crafted query
-
ImpactExfiltrate database data or degrade service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing, authenticated administrative account with access to the affected administrative reporting feature in Kiteworks Core before 9.5.0; the injection is stored, meaning the payload is persisted via that reporting function and executed against the underlying database. Limiting factors: full administrative privileges are mandatory (PR:H), so the flaw is only reachable by trusted admins or an attacker who has already compromised an admin session/credentials - it is not exploitable by unauthenticated or low-privileged users, and no user interaction is needed once admin access is held. |
| Impact | This is a moderate-priority, not a top-tier, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is network-reachable with low complexity, but the PR:H requirement is the decisive limiter: exploitation demands an existing, authenticated administrative account with access to the reporting function. This collapses the threat model from 'remote unauthenticated' to 'malicious or compromised admin', substantially narrowing real-world exposure. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis - no public exploit identified at time of analysis. The vendor's I:H rating appears generous: the description explicitly states the attacker can 'read sensitive data' and 'affect availability' (supporting C:H and A:H), but says nothing about data modification/writes, so a genuine assessment lands closer to I:L for a read/DoS-style SQL injection. Overall the 7.2 severity band is defensible, but the admin-only precondition means this is a high-CVSS-but-modest-real-risk issue absent a separate admin-account compromise vector. |
| Exploit ScenarioDerived | A rogue insider or an attacker who has already phished/hijacked a Kiteworks administrator account navigates to the administrative reporting feature and submits crafted input into a stored parameter used by a report query. The injected SQL executes against the backend database, letting them exfiltrate sensitive stored data (credentials, file metadata, user records) or issue queries that degrade or crash the service. No public proof-of-concept is available, and exploitation is gated behind full administrative access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
RemediationAI
The primary fix is to upgrade Kiteworks Core to version 9.5.0 or later, the version boundary identified in the vendor advisory (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cqg3-857q-cqj6); confirm the exact remediation release against that advisory and the CISA CSAF file before scheduling the upgrade, and validate that no custom reporting templates or saved report definitions carry attacker-injected content forward after the upgrade, since the injection is stored rather than reflected. Until the upgrade can be applied, restrict access to the administrative reporting function to the smallest possible set of trusted admin accounts, enforce phishing-resistant MFA and strong session controls to prevent credential or session theft (the exploit path presumes an already-authenticated administrator), and review administrative audit logs for anomalous or unexpected SQL-like input submitted through reporting forms - accepting that these are compensating controls and not a substitute for patching. Additionally, apply least privilege to the database account used by the Kiteworks application and rotate its credentials as a precaution if compromise is suspected, though this limits rather than eliminates the exposure; enforcing a parameterized-query or input-validation control at a WAF in front of the admin interface may reduce exploitability but carries high false-negative risk and tuning overhead. As of this analysis no public exploit code has been identified, and no vendor workaround beyond upgrading is documented in the supplied references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stored (persistent) SQL injection, CWE-89, in the administrative reporting functionality of Kiteworks Core, a managed file transfer and secure content collaboration platform. Because the injection is stored rather than reflected, attacker-supplied payload is persisted through the reporting interface and subsequently evaluated against the backend database, meaning the malicious input survives beyond the initial request and is re-executed whenever the stored report or its parameters are processed. CWE-89 arises when user-controlled input is concatenated into SQL statements without parameterization or proper input validation; in this case the injection point sits behind the reporting feature's administrative interface. The CPE string cpe:2.3:a:kiteworks:core:*:*:*:*:*:*:*:* is unbounded, and the advisory's version boundary is "before 9.5.0", so all releases prior to 9.5.0 are presumed affected. Network reachability is via the administrative web interface (AV:N), no user interaction is required once admin access exists (UI:N), and the assessed impact is high confidentiality and availability loss with limited integrity impact.
Know when Kiteworks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin function (AV:N/AC:L) but requires administrative privileges (PR:H); description supports data read (C:H) and DoS (A:H) but only incidental integrity impact (I:L), no writes stated.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
2DescriptionCVE.org
Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected reporting function.
Technical POC Analysis
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity SQL injection flaw in Kiteworks Core - the platform used for secure file sharing and content governance - allows someone already holding a full administrative account to read sensitive data from the underlying database and degrade service availability. Because exploitation requires existing administrative privileges and is confined to the administrative reporting feature, the realistic exposure is limited to trusted insiders or attackers who have already compromised an administrator's session, not the general user base. Leadership should treat this as a privileged-insider and data-exfiltration risk that warrants tightening administrative access controls rather than an emergency external-threat response.
No vendor-released patch identified at time of analysis; interim mitigations include restricting or disabling the administrative reporting feature, enforcing MFA and least privilege for administrative accounts, reducing the number of privileged users, rotating administrator credentials, segmenting and monitoring administrative access, forwarding admin activity logs to the SIEM, and applying least-privilege permissions to the application's database account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Exploit-DB