Kiteworks Core CVE-2026-102117

Exploitation requires ALL of: (1) the remote-support capability is licensed and enabled on the deployment (non-default operational state); (2) the attacker is an authenticated System Administrator (PR:H); and (3) that same principal also possesses the key protecting the submitted data. Given those, the admin redirects the outbound support connection to a chosen destination, which can then execute OS commands on the node and receive output, achieving RCE as a local service account. Limiting factors: highest application privilege level required, an additional cryptographic-key possession requirement, and a feature that must be explicitly licensed and turned on - so default deployments without remote-support enabled are not exposed.

All available exploitation signals point to a LOW-to-MEDIUM real-world priority despite the 7.2 (High) base score. The vendor CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description and I agree with it: network-reachable but gated behind PR:H (an authenticated System Administrator who additionally holds the key protecting the submitted data), which sharply limits the attacker population. CWE-807 (reliance on untrusted inputs in a security decision) fits - the outbound support destination is attacker-influenceable, and the redirected endpoint can then push OS commands back to the node. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept identified at time of analysis, so this is not confirmed actively exploited and there is no evidence of weaponization. The high-privilege precondition plus two compounding gating conditions (remote-support must be licensed AND enabled, attacker must also possess the data-protecting key) make automatable, widespread exploitation implausible; realistic risk is a malicious or compromised high-privilege admin escalating from application control to OS-level code execution as a local service account. No conflicting signals in the data - the network vector is consistent with the SaaS/appliance management model.

A malicious or credential-compromised Kiteworks System Administrator who also holds the key protecting the submitted data reconfigures the appliance's outbound remote-support connection to point at an attacker-controlled destination. That destination then feeds operating-system commands back through the support channel, which execute on the node and return their output, yielding remote code execution as a local service account. No public exploit code is known, and exploitation requires the remote-support feature to be both licensed and enabled.