Kiteworks Core EUVD-2026-90295

Requires network access to the Kiteworks appliance SETUP interface, which per the vendor is not reachable on a fully-configured appliance in its default configuration. Exploitation is therefore limited to (1) the transient window while an appliance is first being provisioned, or (2) a non-default appliance configuration that leaves the setup interface exposed. Within that window no authentication is needed (PR:N) and no user interaction is required (UI:N), but the narrow reachability is the dominant limiting factor (AC:H). Impact is file write as the affected service account leading to integrity compromise or denial of service; the flaw does not by itself yield code execution.

This is a genuine but conditionally-gated flaw, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, 7.4) reads unauthenticated-network, which superficially suggests broad exposure - but the AC:H metric and the description together confirm the setup interface is NOT reachable on a fully-configured appliance in its default configuration. Exploitation is confined to the transient first-provisioning window or a non-default configuration that re-exposes the interface, which is exactly what justifies AC:H and materially narrows real-world risk despite PR:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active or automated exploitation. Note the impact is integrity/availability only (C:N/I:H/A:H): the description explicitly stops at file write compromising appliance integrity or availability and does NOT claim code execution on its own, so this is not an RCE. Net: moderate severity gated by a narrow reach window; patch on the normal maintenance cycle rather than treating it as an emergency, but note that any appliance actively being provisioned is momentarily in the exposed state.

During the window when a Kiteworks appliance is first being provisioned (or on an appliance deliberately left in a non-default configuration that keeps the setup interface reachable), an unauthenticated attacker with network access sends a request to the setup interface containing a traversal path, causing a file to be written outside the intended directory to any location the service account can write. The attacker overwrites a critical configuration or application file, corrupting appliance integrity or knocking it offline until an operator manually intervenes. No public exploit code has been identified.