Kiteworks CVE-2026-29092

The risk profile is moderate and somewhat misaligned between different assessment frameworks. The CVSS score of 4.9 is below the typical 7.0 threshold for high severity, yet the vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) reveals important nuance: network-accessible attack surface with low complexity but requiring high privileges (disabled administrator action required to trigger). SSVC signals indicate exploitation is not currently known (none), not automatable (no), and impact is partial technical damage (integrity compromised but not confidentiality or availability). The lack of public POC and no KEV listing suggest this is a lower-priority patch from an exploitation standpoint. However, the high-privilege prerequisite somewhat mitigates severity—an attacker must already have valid account credentials that are then disabled. Organizations with mature account lifecycle management and session monitoring are better protected. This is a real but not critical priority; it should be addressed in regular patch cycles rather than treated as emergency out-of-band remediation.

An employee with legitimate Kiteworks credentials is terminated and their account is disabled by IT administrators. However, before account disablement, the employee had authenticated to the Email Protection Gateway and maintained an active browser session. Due to the vulnerability, that session remains valid and authenticated despite the account disablement, allowing the former employee to continue accessing protected data, reading emails, and potentially modifying gateway configurations until the session naturally times out days or weeks later. An attacker would need prior valid credentials and an active session established before account suspension, making this a low-probability but high-impact scenario.