EUVD-2026-90386Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Advanced Forms endpoint over network
-
ExploitInvoke unauthenticated internal function
-
ExecutionTrigger limited internal service operations
-
ImpactPartial integrity/confidentiality effect on platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Kiteworks Advanced Forms / Secure Data Forms function that was left without an authentication check (CWE-306); no credentials, no user interaction, and no special configuration are needed (AV:N/AC:L/PR:N/UI:N) against affected versions of the Kiteworks platform with the Secure Data Forms/Advanced Forms component deployed and exposed. Exploitation is inherently LIMITED by design of the flaw: the vendor states the reachable function only permits a limited set of internal service operations and explicitly cannot access user accounts, stored files, or form submissions - so impact is bounded regardless of attacker skill. The main limiting factor for defenders is that the affected endpoint must be network-exposed (e.g., internet-facing appliance) for unauthenticated reach. |
| Impact | Moderate real-world risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) indicates a network-reachable, low-complexity, unauthenticated flaw with a scope change but only LOW confidentiality and integrity impact and no availability impact - I concur with this vector. The 7.2 score is driven largely by the unauthenticated (PR:N) + scope-change (S:C) combination rather than by severe impact; the description explicitly caps the damage ('did not permit access to user accounts, stored files, or form submissions'), so this is a bounded missing-authentication (CWE-306) issue on a limited set of internal service operations, not a data-breach or takeover primitive like its unauth-XSS sibling CVE-2026-102147. Exploitation status: no public exploit identified at time of analysis - no CISA KEV listing, no EPSS score, and no POC in the provided references. SSVC-style read: exploitation=none observed, likely automatable given unauth network reach, but technical impact is partial. Net: a genuine patch-worthy issue because it is unauthenticated and internet-reachable, but the explicitly limited impact places it below the RCE/ATO-class flaws in the same Kiteworks batch. No conflicting signals between the CVSS vector and the description. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the Kiteworks Advanced Forms / Secure Data Forms endpoint over the network sends a request to the improperly-unprotected function and invokes a limited set of internal service operations without logging in. Because the affected function crosses a trust boundary (S:C), the operations can influence platform components beyond the forms module, though they cannot read user accounts, stored files, or form submissions. No public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated access to an internal service function in the Kiteworks Advanced Forms / Secure Data Forms component allows remote attackers who can reach the exposed endpoint to invoke a limited set of backend service operations on the Kiteworks platform. The flaw requires no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) and is bounded by design: the vendor states the reachable function cannot access user accounts, stored files, or form submissions, and exploitation is impossible if the component is not network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided; overall this represents a moderate real-world risk concentrated on internet-facing Kiteworks deployments that have the Advanced Forms functionality enabled.
RemediationAI
No exact fix version is provided in the available intelligence, so the primary action is to consult the Kiteworks security advisory GHSA-vwvw-rp3m-rm37 (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vwvw-rp3m-rm37) and the CISA CSAF advisory VA-26-274-01 to obtain the vendor-specified patched release and upgrade to it; if the advisory lists the affected Secure Data Forms line without a tagged fix, treat patch status as unconfirmed and press the vendor for a fixed build rather than assuming the wildcard CPE range is resolved. Until a patch is applied, the most effective compensating control is to remove network reachability to the Advanced Forms/Secure Data Forms function - place it behind an authenticating reverse proxy, VPN, or strict IP allowlist, or disable the component entirely if forms workflows are not in active use; the trade-off is that this breaks legitimate external form submission paths and requires coordination with business owners. Alternatively, restrict access to the specific vulnerable route at the WAF or load balancer, accepting that path-normalization and encoding tricks may evade signature-based blocking, and add monitoring/alerting for anomalous unauthenticated calls into internal service endpoints, which provides detection but not prevention. Because the vector is PR:N/UI:N, there is no credential or user-interaction barrier to rely on, so exposure reduction is the decisive mitigation until an official patch is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-102150 is a CWE-306 Missing Authentication for Critical Function issue in the Kiteworks Advanced Forms component, tracked in CPE data as cpe:2.3:a:kiteworks:secure_data_forms:*:*:*:*:*:*:*:* - a wildcard version range indicating the affected product line as a whole rather than a single release. The root cause class (CWE-306) describes an endpoint or function that performs a privileged or operationally sensitive action but fails to enforce any authentication check before executing it, so anyone who can reach the network service can trigger the underlying logic. The CVSS vector's Scope:Changed (S:C) component is significant: the vulnerable function and the internal service operations it can reach belong to different security authorities, meaning impact extends beyond the entry-point component into the platform's backend services. Confidentiality and Integrity impacts are both Low (C:L/I:L) and Availability is None (A:N), which matches the vendor's statement that only a limited set of internal service operations is reachable and that user accounts, stored files, and form submissions are explicitly out of reach. The vector's PR:N confirms the missing-authentication nature of the defect, and UI:N confirms exploitation is fully automated without victim interaction.
Know when Kiteworks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable function (PR:N/AV:N/AC:L); scope change (S:C) as internal ops affect the broader platform; only low C/I and no A given data access is explicitly excluded.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
2DescriptionCVE.org
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.
Technical POC Analysis
Evidence caveat: the only supplied artefact is advisory GHSA-vwvw-rp3m-rm37.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity flaw in Kiteworks' Advanced Forms / Secure Data Forms component lets an unauthenticated remote attacker invoke a limited set of backend platform operations from any network path that can reach the exposed endpoint. The exposure is confined to internet-facing Kiteworks deployments where Advanced Forms is enabled, and the vendor states the reachable functions cannot touch user accounts, stored files, or submitted forms. Because organizations use Kiteworks to exchange sensitive documents and client data, leadership should treat any externally reachable instance as a priority remediation item even though no public exploit code or active exploitation has been identified.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the Advanced Forms / Secure Data Forms component where it is not operationally required; restrict network reachability to the exposed endpoint using firewall, WAF, or upstream proxy rules and allow only trusted networks or VPN access; ensure the component is not internet-facing; monitor and alert on anomalous calls to internal backend service functions; apply virtual patching or signature-based blocking at the WAF if the vendor provides one.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Exploit-DB