Kiteworks Core EUVD-2026-90305

Exploitation requires an authenticated administrative account with elevated (high) privileges on the Kiteworks Core appliance - PR:H is the dominant limiting factor and removes any possibility of unauthenticated or low-privilege abuse. The attacker sends crafted input over the network (AV:N) to an admin-only function that unsafely passes it to an OS shell; no user interaction and no non-default configuration is indicated. Because the injected command runs as root, the impact is host-level total compromise, but the realistic risk hinges entirely on whether high-privilege admin credentials can be obtained or are already held (insider or compromised-credential threat model).

This is a genuine RCE-class flaw but with meaningful access barriers that cap its real-world urgency at moderate. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) confirms network reachability with low attack complexity and no user interaction, and the full C:H/I:H/A:H triad is fully justified because successful exploitation yields arbitrary OS command execution as root on the appliance node - the worst-case technical impact. However, PR:H is the decisive limiter: the attacker must already hold a high-privileged administrative account, which is why the score sits at 7.2 rather than in the critical range. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or widespread exploitation. In SSVC terms, exploitation is 'none', the technical impact is 'total', but automatability is 'no' because the required prior admin authentication prevents unattended mass exploitation. Net: this is a post-authentication privilege-to-root escalation vector best treated as a defense-in-depth patch (an admin who is already malicious or whose credentials are compromised gains root), not a drop-everything internet-facing emergency. No signals are internally conflicting; the description ('high-privileged authenticated administrator') and the CVSS PR:H are consistent.

An attacker who has obtained high-privileged Kiteworks administrator credentials - via phishing, credential reuse, or an insider - submits crafted input to an administrative function that passes it unsafely to an operating-system shell. The injected command executes as root on the appliance node, giving the attacker full control of the host beneath the application. No public exploit code is currently identified, and exploitation requires the elevated admin account to already be in the attacker's hands.