EUVD-2026-90307Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain code exec as service account
-
DeliveryReach vulnerable privileged routine locally
-
ExploitInject OS command via CWE-78 flaw
-
ExecutionCommand runs as root
-
ImpactFull appliance takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is NOT possible without a prior local foothold: the attacker must already have arbitrary code execution as the unprivileged backend service account on the Kiteworks appliance (AV:L, PR:L). Given that, they invoke a privileged routine that improperly handles attacker-influenced input to execute OS commands as root (CWE-78). Limiting factors: no network vector (AV:L means the network is not directly usable for this flaw), no user interaction required (UI:N), and the entire attack presupposes a separate initial-compromise vulnerability or misconfiguration to reach the service account. This is a privilege-escalation second stage, so realistic risk is bounded by how easily an attacker can first reach that service account on a given deployment. |
| Impact | This is a genuine but conditional risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) makes the gating factor explicit: AV:L and PR:L mean the attacker must ALREADY be executing code as an unprivileged backend service account on the appliance before this flaw is usable - it is a second-stage local privilege escalation, not an initial-access vector. The high 7.8 score reflects the full-root technical impact (C:H/I:H/A:H) once triggered, but does NOT indicate remote reachability. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. SSVC-style reading: exploitation=none-observed, automatable=no (requires a prior foothold that varies per environment), technical impact=total. Net: treat this as a defense-in-depth / post-compromise hardening priority rather than an emergency remote patch. The real question for defenders is not 'can someone reach it over the network' (they cannot directly) but 'has any other bug or misconfiguration already given an attacker service-account code execution' - this flaw would then convert that into full root. |
| Exploit ScenarioDerived | An attacker first gains code execution as the low-privileged backend service account - for example by chaining a separate Kiteworks web/application vulnerability or an exposed misconfiguration. Using that foothold, they invoke the vulnerable privileged routine, injecting OS commands (CWE-78) that execute as root, giving them complete control of the appliance. No public exploit code is currently identified, and the attack requires the prior local foothold, so it is realistic only as the escalation stage of a multi-step compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Local privilege escalation in Kiteworks Core lets an attacker who already holds code execution as an unprivileged backend service account invoke a privileged routine that mishandles attacker-influenced input, running arbitrary OS commands as root. The flaw requires a prior local foothold on the appliance - the CVSS vector (AV:L, PR:L, UI:N) confirms it cannot be reached directly over the network and demands an existing initial compromise or misconfiguration to obtain the service account. No public exploit code or active exploitation is identified at time of analysis, and the realistic risk is bounded by how easily that initial service-account access can be obtained on a given deployment; the vendor's advisory is GHSA-658c-86vw-g9hf.
RemediationAI
No exact fixed version is identified in the supplied data, so administrators should check the vendor advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-658c-86vw-g9hf and the accompanying CSAF file (va-26-274-01.json) for the current patched release and apply it as soon as it is listed. Until a patch is confirmed, the most effective controls target the prerequisite rather than the flaw itself: treat the backend service account as a high-value credential and strictly limit who or what can obtain code execution under it, since the exploit is unusable without that foothold. Concretely, disable interactive shell and SSH login for the service account, remove any unnecessary sudo or setuid paths reachable by it, confine the service with AppArmor/SELinux or container-level seccomp policies that block execution of shell interpreters from the appliance's backend processes, and monitor process lineage for commands spawned by the backend service that launch /bin/sh or write outside their expected paths. Each of these carries trade-offs - mandatory access control confinement and shell restrictions can break legitimate maintenance scripts or vendor support workflows, so test in a staging appliance first, and note that none of them eliminates the flaw: after the initial service-account compromise, the root escalation path remains available until the vendor patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-78, OS command injection: a root-privileged routine within Kiteworks Core passes attacker-influenced input into an operating-system command without adequate neutralization, so arguments or shell metacharacters controlled by the calling service account are executed with root authority. Kiteworks Core is the appliance platform referenced by the wildcard CPE cpe:2.3:a:kiteworks:core:*:*:*:*:*:*:*:*, indicating the vendor has not published a per-version fixed-version mapping in the supplied data. The assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes an attack that is local (no network reachability for this specific flaw), low complexity once the prerequisite is met, requires low privileges (the backend service account), needs no user interaction, and is scoped to the same security authority - but yields high confidentiality, integrity, and availability impact because the resulting process runs as root. This is a classic second-stage privilege escalation: the vulnerable code path assumes the caller is trusted and does not re-validate or sanitize the input it forwards to a shell.
Know when Kiteworks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing local foothold as the unprivileged service account (AV:L, PR:L); no user interaction; escalation yields root with full confidentiality, integrity, and availability impact on the same appliance (S:U).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
2DescriptionCVE.org
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.
Technical POC Analysis
Evidence caveat: the only artifact supplied is advisory GHSA-658c-86vw-g9hf.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Kiteworks Core, the file-sharing and content-governance platform that many organizations rely on to move sensitive data both internally and with third parties, contains an unpatched local privilege-escalation flaw that allows an attacker who already holds a foothold on the appliance to escalate to full root control. The exposure is not remotely reachable, but on any deployment where a backend service account is compromised or misconfigured, the blast radius extends to every document, credential, and integration the appliance touches. Leadership should care because the affected asset is typically a trust anchor for regulated and confidential content, and no vendor fix is currently available to close the gap.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege and remove shell access from backend service accounts, restrict appliance access to trusted administrative networks only, eliminate default or shared service credentials, apply file-integrity monitoring to Kiteworks binaries and configuration, and enable host-level detection for unexpected root process creation originating from service accounts. Monitor vendor advisory GHSA-658c-86vw-g9hf for a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Exploit-DB