Kiteworks Core EUVD-2026-90301

Requires the attacker to ALREADY hold local command execution as the low-privileged Kiteworks service account on the appliance (PR:L, AV:L) - this is not remotely reachable on its own and is realistically a second-stage escalation following a separate initial-access vulnerability. Given that foothold, no user interaction, no extra credentials, and no non-default configuration are required: the flaw is a link-following (CWE-59) weakness in a root-privileged operation on the Kiteworks Core appliance. The principal limiting factor is the prerequisite service-account foothold; the principal risk is that success grants full root control of the appliance.

This is a genuine but chained/secondary-priority issue rather than a top-of-queue emergency. The CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description: exploitation is LOCAL (AV:L), requires an already-authenticated low-privileged foothold (PR:L), needs no user interaction, and yields full compromise of the appliance (C:H/I:H/A:H via root). The high base score is driven by the total-compromise impact, not by ease of initial reach - the AV:L/PR:L prerequisite means the attacker must ALREADY have a shell as the service account before this bug is useful. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. There is no signal conflict - all signals point to a real-but-gated local escalation. The primary risk multiplier is that on a hardened appliance the whole security model rests on the service account NOT being root; this bug collapses that boundary, so it is a valuable second stage in any chain that first achieves service-account code execution on a Kiteworks node (e.g. the SSRF/RCE/deserialization siblings in the same va-26-274-01 batch).

An attacker who has already obtained command execution as the low-privileged Kiteworks service account - for example by chaining a separate application-level RCE or upload flaw on the appliance - abuses a link-following (CWE-59) weakness in a root-owned/root-executed operation to have a privileged process act on an attacker-controlled symlink, resulting in root on the appliance. No user interaction and no additional credentials are required once the local foothold exists. No public exploit code was identified at time of analysis.