Kiteworks CVE-2026-24751

Exploitation requires the target Kiteworks deployment to have the Secure Data Forms feature enabled and reachable by the attacker (typically over the public internet, since Kiteworks is commonly exposed for external collaboration), and the victim must click an attacker-crafted URL containing the malicious payload (UI:R). No authentication is required of the attacker (PR:N), but the value of the attack depends on the victim being an authenticated Kiteworks user whose session can be hijacked or whose form input can be intercepted. Kiteworks versions 9.3.0 and later are not vulnerable, and deployments that do not use Secure Data Forms are not exposed to this specific flaw.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction and crosses a security scope, yielding a base score of 8.2 - elevated for reflected XSS because Kiteworks handles regulated and sensitive data, so session theft or form-data exfiltration directly impacts confidentiality (C:H). EPSS data was not provided in the input, and the CVE is not in CISA KEV; no public exploit identified at time of analysis. Realistic risk is moderate: the score is driven by the high-value target context rather than ease of mass exploitation, since UI:R limits worm-like spread and typical mitigations (URL filtering, NoScript, modern browser XSS auditors) reduce success rates. Verify EPSS independently before deprioritizing - the absence of an EPSS figure in the input is a data gap, not a low-risk signal.

An attacker crafts a malicious URL pointing at a victim organization's Kiteworks Secure Data Forms endpoint with a JavaScript payload embedded in a reflected parameter, then sends it via phishing email or chat to an employee or partner expected to fill out a Kiteworks form. When the target clicks the link, the injected script executes in the Kiteworks origin and can steal session cookies, harvest form input as it is typed, or pivot to other Kiteworks application functionality the user is authorized for.