Kiteworks Core EUVD-2026-90274

Requires an authenticated Kiteworks Core administrator account (PR:H) with access to the administrative import feature; the attacker must supply a file whose header passes validation while its full contents are forged or otherwise unverified. Exploitation is limited to affected versions (core < 9.5.1) and is capped at data-integrity impact - no confidentiality or availability effect and no user interaction is required. The admin-privilege prerequisite is the primary factor limiting real-world risk.

This is a genuinely low-to-moderate priority issue whose CVSS base score of 4.9 (Medium) accurately reflects a constrained flaw rather than an understated one. The vendor CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N is internally consistent and I agree with it: network-reachable and low-complexity, but gated behind PR:H - the actor must already hold authenticated administrator privileges on Kiteworks Core, and the only impact is to integrity (C:N/A:N). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision record in the input to weigh. The single largest limiting factor is the pre-existing admin requirement: an attacker who can already invoke administrative import functions has a high level of trust, so this is best viewed as a defense-in-depth / integrity-assurance gap (accepting forged import content because only the file header - not the full file - is validated) rather than an initial-access or takeover vector. The 'Information Disclosure' tag in the input directly contradicts the CVSS vector (C:N, no confidentiality impact) and should be treated as erroneous.

A user who already holds Kiteworks Core administrator rights (or an attacker who has hijacked such an account) submits a forged or tampered import file whose header is crafted to pass the partial validation while the body carries unverified content. Because the application checks only the header and not the complete file, the malicious content is accepted and processed, corrupting the integrity of the imported data. No public exploit code is identified in the available intelligence.