EUVD-2026-90304Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote reset bypass over the network (PR:N/AV:N/AC:L/UI:N) yields full account and admin takeover, giving complete confidentiality, integrity, and availability impact within the application scope.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
AnalysisAI
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally stored passwords - including administrative accounts - by abusing insufficient parameter validation in the password reset workflow, which lets them bypass the emailed reset-link step and set a new password themselves before authenticating as that user. The flaw is classified CWE-640 (weak password recovery mechanism) and scores CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no non-default configuration are required; any internet-reachable Kiteworks Core instance hosting local-password accounts is exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the Kiteworks Core password reset workflow, which fails to correctly validate a submitted parameter (CWE-640), allowing the emailed reset-link step to be bypassed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The provided data does not identify an exact fixed version, so the primary action is to consult the Kiteworks security advisory GHSA-q76w-qv9j-q639 (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639) and the corresponding CSAF record (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json) to obtain the vendor's fixed release and upgrade to it as the only complete fix; because the CPE is wildcarded across Kiteworks Core versions, do not assume a current build is patched without vendor confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every internet-reachable Kiteworks Core instance and determine which accounts authenticate with locally stored passwords rather than federated identity; where feasible, disable local password authentication entirely and force all users, especially administrators, onto SSO/SAML or another externally managed identity provider, and immediately rotate credentials for any privileged local accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today