Kiteworks CVE-2026-23514

Authenticated user account required on Kiteworks Core versions 9.2.0 or 9.2.1. Attacker must have valid login credentials. No victim interaction needed. Remote network access to the Kiteworks instance required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable vulnerability with low attack complexity requiring only low-privilege authentication, with high impact to confidentiality, integrity, and availability. The vulnerability is highly exploitable once an attacker has authenticated access to the system, with no user interaction required. However, the PR:L requirement means attackers need valid credentials, which provides some barrier to exploitation. Without EPSS data or KEV listing, there is no indication of active in-the-wild exploitation. The primary risk is to organizations using affected Kiteworks versions where insider threats or compromised low-privilege accounts could escalate access to sensitive content. Given the specific version scope (only 9.2.0 and 9.2.1) and availability of a patch, this represents a manageable but urgent remediation priority for affected deployments.

An attacker with valid low-privilege credentials (such as a basic user account or compromised contractor credentials) authenticates to the Kiteworks Core platform over the network. Due to the access control flaw, the authenticated user crafts requests to access confidential files, folders, or data belonging to other users or restricted organizational units, successfully bypassing intended authorization checks. The attacker can then read, modify, or exfiltrate sensitive documents they should have no access to, such as financial records, intellectual property, or executive communications stored within the private content network.