Kiteworks CVE-2026-23636

The CVSS v3.1 score of 5.5 (Medium severity) reflects a nuanced risk profile: the attack vector is network-based with low complexity, but requires high privileges (PR:H), reducing the overall severity. The integrity impact is high (I:H) while availability impact is low (A:L), indicating file corruption or injection is the primary concern rather than system-wide outage. However, this CVSS score should not be underestimated—CWE-434 vulnerabilities are historically dangerous and frequently lead to remote code execution when combined with web server misconfigurations (e.g., executable permissions in upload directories). Without confirmed EPSS data or KEV listing in this dataset, the real-world exploitability depends on whether uploaded files can be executed by the web server or accessed by other users. The requirement for manager-level authentication significantly reduces the attack surface, making this an insider threat or post-compromise lateral movement vector rather than a primary access mechanism. Organizations should prioritize patching but recognize this is lower risk than unauthenticated file upload vulnerabilities.

A malicious insider with form manager credentials, or an external attacker who has compromised a manager account through phishing, could upload a web shell or executable script disguised with a dangerous file extension through the Secure Data Forms interface. If the upload directory is executable or if the file can be accessed via the web root, the attacker gains remote code execution with the privileges of the web server process, allowing them to exfiltrate sensitive data stored on the PDN, establish persistence, or pivot to internal systems. The attack requires low technical complexity and network access only (no special tools), making it a practical post-authentication attack vector.