Kiteworks Core EUVD-2026-90381

Requires an authenticated administrator account on the Kiteworks Core appliance (PR:H) reaching the affected admin interface; there is no user-interaction requirement (UI:N). Exploitation is limited by the need for administrative privileges and by the fact that, on its own, the flaw only permits issuing/interacting with internal network services (SSRF) and does not achieve code execution - impact chaining would require a separate vulnerability. Affects Kiteworks Core versions before 9.5.1; a vendor patch is available.

All exploitation signals point to a moderate, access-gated issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L, base 6.6) requires PR:H - an authenticated administrator - which sharply limits the attacker population to already-trusted operators or someone who has first compromised admin credentials. The scope change (S:C) and network vector reflect that the flaw lets the appliance pivot to internal services beyond its intended reach (classic SSRF behavior), but the low C/I/A impacts indicate only partial read/interaction capability, and the description explicitly states this 'did not result in code execution' on its own. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent exploitation. Note a data discrepancy: the assigned CWE-93 (Improper Neutralization of CRLF Sequences) does not match the description, which reads as a Server-Side Request Forgery (CWE-918) issue - verify the weakness classification with the vendor. Net: a real but low-to-medium priority defense-in-depth fix, not a high-real-risk emergency despite the mid-range CVSS.

An authenticated Kiteworks administrator (or an attacker who has obtained admin access) submits a crafted request through the affected admin interface that causes the appliance to issue outbound requests to internal-only network services, enabling interaction with resources not meant to be reachable through that interface. The attacker uses this to probe or interact with internal services for reconnaissance or limited data retrieval; no public exploit is identified at time of analysis, and the flaw does not yield code execution by itself.