Kiteworks Core EUVD-2026-90308

Requires an authenticated administrator account on a Kiteworks Core deployment prior to version 9.5.0 with the ability to edit security-policy settings. Exploitation consists of assigning a value outside the intended range to a configurable security-policy control so it never activates; the control continues to display as enabled in the admin interface and audit log, masking the change. Limiting factors: full administrative privileges are required (PR:H), there is no confidentiality or availability impact, and the effect is a silent weakening of a control rather than direct system compromise - so realistic risk is confined to insider misuse or an already-compromised admin session.

This is a genuinely low-priority issue despite being network-vector. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, 4.9 Medium) is internally consistent and I agree with it: the PR:H requirement means the actor must already be an authenticated administrator, and the only impact is integrity (I:H) - a security control is silently neutralized, with no confidentiality (C:N) or availability (A:N) consequence. There is no EPSS score, no CISA KEV listing, and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is muted because the 'attacker' is a privileged admin misconfiguring (or deliberately weakening) their own tenant's policy rather than an external intruder gaining new access - this is closer to an insider/mistake-tolerance defect than a remotely weaponizable flaw. The notable twist that elevates it slightly above pure misconfiguration is the deceptive state: the control continues to appear enabled in both the admin UI and the audit log, so a weakened policy can go undetected by defenders and auditors. No key signals conflict; the only data-quality issue is the 'Information Disclosure' tag, which contradicts the C:N/I:H vector (this is an integrity/security-control-bypass issue, not disclosure).

A malicious or coerced Kiteworks administrator sets a configurable security-policy value (e.g., a threshold or limit) above its intended maximum so the associated control silently stops enforcing, while the UI and audit log still show it as enabled. The weakened posture then persists undetected until an unrelated event exposes it. No public proof-of-concept exists and exploitation requires existing administrative privileges.