Kiteworks Core EUVD-2026-90279

Requires a MULTI-NODE (clustered) Kiteworks Core deployment - single-node installs are not exposed via this path. The attacker must ALREADY possess code execution on one appliance node, since the vulnerable input is reachable only through the internal cluster interface, not from the public network. Exploitation writes an unvalidated value into the monitoring configuration of a second node; resulting command execution is limited to an unprivileged service account, so it does not directly yield root/privileged control on the target node. Affected versions are Kiteworks Core below 9.5.1; patched in 9.5.1.

This is a genuinely low-to-medium priority issue despite the OS-command-execution potential, because every strong exploitation signal is gated. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, 6.3) explicitly requires LOCAL access and LOW privileges - and the description clarifies that 'local' here means the attacker must ALREADY have code execution on one appliance node in a multi-node cluster. There is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis, so exploitation status is: no public exploit identified at time of analysis. The scope change (S:C) is the one aggravating factor - the injected value crosses from one node into the monitoring configuration of a different node - but the resulting command execution is confined to an unprivileged service account, which is why C/I/A are all Low rather than High. No SSVC decision data was supplied. Net: this is a real defense-in-depth flaw for lateral movement within a compromised cluster, not a widespread remote-exploitation priority. It should be patched but does not warrant emergency response absent evidence of an initial-access chain.

An attacker who has already compromised one Kiteworks appliance node (via a separate initial-access vulnerability) submits a crafted value through the internal cluster interface. That value is written into the monitoring configuration on a second node without sufficient neutralization of special/CRLF elements (CWE-93), causing OS commands to run on that second node as the unprivileged service account, extending the attacker's foothold laterally across the cluster. No public POC is identified at time of analysis.