Kiteworks Core EUVD-2026-90285

Requires an authenticated delegated (non-system) administrator account holding at least one narrowly scoped administrative permission on Kiteworks Core prior to 9.5.1. The specific trigger is the administrative import function used to import an integration credential: it fails to verify that the requesting administrator is entitled to create the privileged credential being imported. No user interaction from any existing system administrator is needed (UI:N), and no non-default configuration is required beyond the presence of a delegated-admin role - this is the intended least-privilege delegation model being subverted. The principal limiting factor is the PR:H prerequisite: an external unauthenticated attacker cannot reach this path without first obtaining delegated-admin credentials.

Vendor CVSS 3.1 rates this 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and I concur with the metrics - the one nuance is that PR:H is genuine and materially caps real-world risk: the attacker must already hold a valid delegated-administrator account with at least one narrowly scoped admin permission, so this is an insider/lateral privilege-escalation issue, not an unauthenticated internet-facing takeover. No EPSS score, KEV entry, or public POC is provided; per the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision block in the input. The signals are internally consistent (no CVSS-vs-description conflict): AV:N is reasonable because the administrative import function is reached over the management network/API, and the C:H/I:H/A:H total-impact rating is justified because the end state is full system-administrator privilege. Net: a real and serious escalation-of-privilege flaw for organizations that use Kiteworks delegated/least-privilege admin models, but the PR:H gate and absence of any exploitation evidence place it below the unauthenticated Kiteworks issues in the same advisory batch - treat as a prompt-patch item rather than an emergency.

An organization delegates a single narrow admin permission (for example, integration or import management) to a junior operator. That operator uses the administrative import function to import a privileged integration credential; because the function never checks whether the requesting admin is entitled to create that credential, the operator effectively grants themselves full system-administrator rights with no action by any existing sysadmin. No public exploit code is currently identified.