EUVD-2026-90276Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Agree with vendor: AC:H and the data-influence precondition gate exploitation, AV:L per vendor reachability, S:C and C/I/A:H reflect full appliance RCE once the sink is reached.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.
AnalysisAI
Deserialization of untrusted data in Kiteworks Core before 9.5.0 can escalate to remote code execution on the appliance, but only as a secondary, chained weakness rather than a standalone attack. The issue is not exploitable in isolation: an attacker must first obtain a way to influence the data that Core deserializes, which in practice means chaining a separate flaw (for example one of the file-write or injection issues in the same CISA CSAF batch, va-26-274-01) or leveraging an existing foothold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Not exploitable in isolation: the attacker must first obtain the ability to influence the data that Kiteworks Core deserializes (per the description), which in practice means chaining a separate primary vulnerability - such as one of the file-write or injection flaws in the same va-26-274-01 batch - or an existing foothold. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely lower-priority issue than its 8.1 base score suggests, because the vulnerability is explicitly a secondary/chained weakness. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Kiteworks Core to 9.5.0 or later, which is the version boundary at which this deserialization flaw is addressed; consult GHSA-x5hx-fgrp-prvf (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-x5hx-fgrp-prvf) and the CISA CSAF bundle va-26-274-01 (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json) for the vendor's exact instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kiteworks Core appliances and confirm which run versions before 9.5.0; isolate or restrict network access to those systems, review logs for suspicious file-write, injection, or post-exploitation activity, and confirm the vendor advisory status because no vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today