EUVD-2026-90299Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Function reachable only from inside the cluster and requires prior node access, so AV:L/PR:L; crossing to another node is a scope change (S:C) with elevated OS command exec giving full C/I/A:H.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in an internal cluster management function let attacker-supplied values reach a privileged execution context; exploitation requires existing access to a node in the cluster, and the affected function is not reachable from outside the cluster.
AnalysisAI
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execution on one node of a clustered deployment to run operating system commands with elevated privileges on other nodes in the same cluster. The vulnerable function is not reachable from outside the cluster, so the attack path is confined to the internal cluster network and requires a pre-existing foothold on a cluster member; single-node deployments are not exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the deployment to be a clustered (multi-node) Kiteworks Core installation AND the attacker to have already achieved code execution on at least one node of that cluster. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional high-severity issue rather than an internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed release identified in the Kiteworks advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m968-434m-rgwp; the provided intelligence does not disclose an exact fix version number, so confirm the target build against that advisory before upgrading, and prioritize clustered deployments over single-node ones. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the first 24 hours, inventory all Kiteworks Core deployments and classify each as single-node or clustered, since only clustered instances are affected; for every clustered deployment, verify that cluster-management interfaces are bound to an isolated internal network segment and are not reachable from general user, VPN, or DMZ networks, and confirm that no unmanaged hosts share that segment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same weakness CWE-78 – OS Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today