Kiteworks Core CVE-2026-102133

Exploitation requires ALL of: (1) an authenticated system administrator account (PR:H); (2) the optional, separately-licensed repository-connector feature being deployed and enabled on the appliance - it is not present in a default/base configuration; (3) network egress from the appliance to a system under the attacker's control, per the description's explicit statement. The affected version is Kiteworks Core below 9.5.1. These layered conditions (admin privilege, non-default licensed feature, and outbound reachability) are the practical limiting factors and substantially reduce the exploitable population beyond what the network attack vector alone implies; there is no user-interaction requirement (UI:N).

This is a genuine but constrained vulnerability whose real-world risk is LOW-to-MEDIUM despite the RCE outcome. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.6) is well-justified and I agree with it: the full-CIA impact reflects real code execution as the connector service account, but three stacked preconditions hold the score down - PR:H (an already-authenticated system administrator), AC:H (the vulnerable repository-connector is an optional, separately-licensed feature that must be deployed, AND exploitation requires the appliance to have network egress to an attacker-controlled system), and the absence of scope change (S:U, execution stays within the service account context). Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no EPSS score supplied, and no POC referenced. All signals are internally consistent - a high-privilege, high-complexity, environment-dependent flaw - so there is no CVSS-versus-description conflict to reconcile. The main threat model is a malicious or compromised administrator, or an attacker who has already obtained admin credentials, rather than opportunistic mass exploitation; the egress requirement further scopes it to appliances that can reach out to the internet or attacker-reachable infrastructure. Priority is patch-on-cycle (upgrade to 9.5.1) rather than emergency.

An authenticated Kiteworks system administrator (or an attacker who has phished/stolen admin credentials) targets an appliance where the optional, licensed repository-connector feature is deployed. They supply a path containing shell metacharacters that the connector passes unsanitized to an external command, appending their own commands that execute as the connector's service account and write attacker-controlled content to files, then use the appliance's outbound network egress to a system they control to complete the operation (e.g. stage or retrieve a payload). No public exploit code or active exploitation is currently known.