Kiteworks CVE-2026-24754

The attacker must hold a valid Kiteworks account with at least low-level privileges (confirmed by CVSS PR:L); anonymous or external unauthenticated access is insufficient. The Secure Data Forms feature must be accessible to the attacker's account role. Exploitation further requires a second authenticated victim user to open or otherwise interact with the attacker-controlled form entry (CVSS UI:R), introducing a timing and availability dependency. Exploitation is limited to Kiteworks deployments running versions prior to 9.3.0. The attack does not require special network positioning, physical access, or elevated attacker privileges - once the attacker holds valid credentials and form-write access, the delivery mechanism is fully network-based. What limits exploitation in practice: attacker must have an active platform account, victim interaction cannot be forced, and the attack surface is restricted to the Secure Data Forms feature specifically rather than the broader application.

The CVSS 5.4 Medium score reflects a balanced threat profile: the attack is network-delivered with low complexity (AV:N/AC:L), but meaningfully gated by the requirement for an existing low-privilege Kiteworks account (PR:L) and mandatory victim interaction with the poisoned form (UI:R). The changed scope (S:C) elevates the score by capturing cross-session impact. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified from this dataset - this is a gap in the available intelligence. There is no CISA KEV listing and no publicly identified proof-of-concept, indicating no confirmed mass exploitation. The realistic risk is moderate-to-contextual: for organizations using Kiteworks Secure Data Forms as part of regulated data workflows, a stored XSS with cross-session scope could enable targeted session hijacking or business data compromise by a malicious insider or compromised account. For deployments where Secure Data Forms are not used or attacker account access is tightly controlled, realized risk is substantially lower than the CVSS score alone implies.

An attacker with a valid low-privilege Kiteworks account submits a crafted payload containing malicious JavaScript into a Secure Data Forms field, where it is stored server-side. When a second authenticated user - such as an administrator or business collaborator - subsequently opens or interacts with the poisoned form entry, the script executes automatically in their browser session, potentially exfiltrating their session cookie or performing authenticated actions on their behalf. No public proof-of-concept has been identified, but the stored XSS attack pattern is well-understood and requires no specialized tooling beyond standard web testing techniques.