What is the CVSS score of CVE-2026-24750?

CVE-2026-24750 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Kiteworks are affected by CVE-2026-24750?

Kiteworks Secure Data Forms versions prior to 9.2.1 contain a stored cross-site scripting vulnerability that allows authenticated users with low-level privileges to inject malicious scripts into…. A patch is available.

How to fix or mitigate CVE-2026-24750?

Within 24 hours: Identify all Kiteworks Secure Data Forms deployments and document current versions in your environment. Within 7 days: Test and deploy vendor patch to version 9.2.1 or later in a staging environment; restrict form modification privileges to trusted administrators only as interim control. Within 30 days: Complete production deployment of patched version 9.2.1+, validate functionality across dependent systems, and audit form modification logs for unauthorized changes.

Kiteworks CVE-2026-24750

EUVD-2026-15455 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 GitHub_M

XSS Kiteworks Secure Data Forms

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

9.2.1

EUVD ID Assigned

Mar 25, 2026 - 15:46 euvd

EUVD-2026-15455

Analysis Generated

Mar 25, 2026 - 15:46 vuln.today

CVE Published

Mar 25, 2026 - 15:22 nvd

HIGH 7.6

DescriptionGitHub Advisory

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms that allows authenticated attackers to inject malicious scripts when modifying forms. Kiteworks Secure Data Forms versions prior to 9.2.1 are affected, enabling attackers with low-level privileges to execute arbitrary JavaScript in victims' browsers. There is no indication this vulnerability is actively exploited (not in CISA KEV), and no public proof-of-concept has been identified in available intelligence.

Technical ContextAI

Kiteworks is a private content network platform designed for secure file sharing and collaboration. The vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), exists in the Secure Data Forms component. The affected product is identified by CPE cpe:2.3:a:kiteworks:secure_data_forms:*:*:*:*:*:*:*:*. The root cause is insufficient input validation and output encoding when processing user-supplied data during form modification operations, allowing malicious JavaScript to be stored in the application database and later executed in the context of other users' browser sessions. This is a classic stored XSS vulnerability where the malicious payload persists in the application rather than being reflected immediately.

RemediationAI

Upgrade Kiteworks Secure Data Forms to version 9.2.1 or later immediately to receive the patch that addresses this stored XSS vulnerability. The vendor security advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rfwm-2hq6-h84g provides official upgrade guidance and release notes. Until patching is completed, organizations should implement compensating controls including restricting form modification privileges to only highly trusted users, implementing Content Security Policy (CSP) headers to mitigate XSS execution, enabling aggressive input validation at network perimeter devices, and monitoring form modification activities for suspicious patterns. Review existing forms for potentially malicious content introduced prior to patching.