Kiteworks Core CVE-2026-102124

Exploitation requires that the Kiteworks Core appliance has already COMPLETED its initial configuration - the setup interface stops enforcing authentication in this post-provisioning state, and the attacker must have network access to that interface. No credentials, no user interaction, and no non-default feature toggles are needed. The primary limiting factor is impact scope, not access: the attacker can only read and modify a limited set of setup records (contact name and email address), with no code execution, no full configuration control, and no availability impact. Network exposure of the appliance's setup/management interface is the key real-world gate - appliances whose management plane is segmented or firewalled off are not remotely reachable.

This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity access with no user interaction - attractive prerequisites - but the impact is deliberately narrow: C:L/I:L/A:N reflects read/modify access to only a limited set of setup records (a contact name and email captured at initial configuration), not full appliance takeover or code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automated exploitation; the 6.5 score is driven by the unauthenticated network reachability rather than by severe impact. No SSVC decision data was supplied. There are no conflicting signals here - the CVSS vector and the description are consistent (both point to unauthenticated network access with limited confidentiality/integrity impact). The realistic risk is information disclosure of a support/admin contact and possible tampering of that record, not a foothold for deeper compromise on its own.

An attacker with network reachability to a Kiteworks appliance that has completed initial configuration sends requests directly to the setup interface, which no longer enforces authentication post-provisioning. Without any credentials, the attacker retrieves the administrative contact name and email address and can alter those setup records. No public exploit code was identified, and the low complexity (AC:L) means no special timing or conditions are needed once the endpoint is reachable.