Kiteworks
Monthly
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); a vendor patch is available in 9.5.0.
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attackers reach administrative functions simply by citing a valid administrator account identifier, without supplying the corresponding password or any token. Exploitation allows creation, modification, or deletion of internal users and managed domains and changes to security-feature configuration; deleting a managed domain also removes its user accounts and can lock legitimate administrators out of the gateway, consistent with the assessed vector's high integrity and availability impact and no confidentiality impact. The vendor has released fixed version 9.5.0, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV at time of analysis; the main gating factor is that the attacker must know or guess an existing administrative account reference and be able to reach the administrative service over the network.
Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and vendor-patched versions are available.
Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.
Local privilege escalation in Kiteworks Core lets an attacker who already holds code execution as an unprivileged backend service account invoke a privileged routine that mishandles attacker-influenced input, running arbitrary OS commands as root. The flaw requires a prior local foothold on the appliance - the CVSS vector (AV:L, PR:L, UI:N) confirms it cannot be reached directly over the network and demands an existing initial compromise or misconfiguration to obtain the service account. No public exploit code or active exploitation is identified at time of analysis, and the realistic risk is bounded by how easily that initial service-account access can be obtained on a given deployment; the vendor's advisory is GHSA-658c-86vw-g9hf.
Local privilege escalation in Kiteworks Core lets an attacker who already has code execution as an unprivileged backend service account on the appliance obtain root. A privileged, root-owned routine consumes a filesystem path that the lower-privileged service account can influence, so the attacker can steer that root operation into executing arbitrary commands with full privileges (CWE-59 link-following / unsafe path handling). The attack is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and is a second-stage primitive requiring an existing foothold; no public exploit was identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV), though the 7.8 severity and availability of a vendor advisory make prompt patching advisable.
Command injection in Kiteworks Core lets an authenticated administrator with elevated privileges run arbitrary operating-system commands as root on the affected appliance node, so an admin-only function can be turned into full host compromise. The flaw is remotely reachable and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N, base score 7.2), but PR:H is the dominant limiting factor: no unauthenticated or low-privilege path is indicated, so practical exploitation presupposes an insider or stolen high-privilege administrative credentials. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, keeping real-world urgency moderate and dependent on the value of the credentials required.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally stored passwords - including administrative accounts - by abusing insufficient parameter validation in the password reset workflow, which lets them bypass the emailed reset-link step and set a new password themselves before authenticating as that user. The flaw is classified CWE-640 (weak password recovery mechanism) and scores CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no non-default configuration are required; any internet-reachable Kiteworks Core instance hosting local-password accounts is exploitable. Independent assessment rates this a genuine top-priority issue rather than a high-score-but-low-risk case. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, low-complexity nature warrants urgent action.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
OS command execution in Kiteworks Core is possible when the remote-support capability is licensed and enabled and an authenticated System Administrator also possesses the key protecting submitted data, allowing that administrator to redirect the outbound support connection to an attacker-chosen destination that can then execute OS commands with local service account privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so exploitation requires high application privileges plus the additional key-possession condition, and deployments without remote support enabled are not exposed; there is no public exploit identified at time of analysis and no CISA KEV indication. The independent assessment rates real-world priority low-to-medium despite the 7.2 High base score.
Local privilege escalation in Kiteworks Core allows an attacker who already holds a shell under a low-privileged service account to elevate to root on the appliance, gaining complete control of the system and the sensitive content it brokers. The weakness is a link-following issue (CWE-59) in a root-privileged operation, reachable with local access as the service account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no non-default configuration, making it a realistic second-stage escalation after a separate initial-access compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVE is not associated with a KEV listing; the primary limiting factor is the prerequisite service-account foothold, while the primary risk is full root compromise of the appliance.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execution on one node of a clustered deployment to run operating system commands with elevated privileges on other nodes in the same cluster. The vulnerable function is not reachable from outside the cluster, so the attack path is confined to the internal cluster network and requires a pre-existing foothold on a cluster member; single-node deployments are not exposed. Rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change reflecting cross-node impact, and no public exploit identified at time of analysis.
The anonymous form-rendering endpoint in Kiteworks' Advanced Forms / Secure Data Forms component returns more information than a published form needs, letting anyone who knows or can guess a published form's web address retrieve the form owner's Kiteworks account profile (including personal details) plus portions of the deployment's configuration settings. No authentication or user interaction is required against a default deployment that serves published forms, and the exposed data does not include passwords, authentication tokens, or MFA secrets. Scoring is CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), driven entirely by confidentiality loss with a scope change since an unauthenticated viewer gains data belonging to a different security authority; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote attacker cause the gateway itself to send crafted requests to internal or otherwise unintended network destinations by simply sending an inbound message that triggers an online certificate status check. Because the request originates from the gateway's own network position, an attacker can potentially reach internal services that are not directly exposed, leading to sensitive information disclosure and, depending on reachable targets, disruption of gateway availability. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); exploitation is nevertheless trivially reachable since it requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 9.1), with realized impact bounded by the gateway's internal network position and egress restrictions.
Unauthenticated path traversal in the Kiteworks Core appliance setup interface allows an attacker who can reach that interface to write a file to any location writable by the appliance service account, enabling integrity compromise of the appliance or a denial-of-service condition that persists until an operator intervenes. The exposure is narrow: the setup interface is not reachable on a fully configured appliance in its default configuration, so exploitation is realistically limited to the transient provisioning window of a new appliance or a non-default configuration that leaves setup exposed, which is why AC:H applies despite PR:N and UI:N (CVSS 7.4). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw does not by itself provide code execution.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) to make the gateway fetch attacker-chosen URLs by embedding a crafted certificate revocation list reference in an inbound message. Successful exploitation yields disclosure of information reachable from the gateway's network position or disruption of gateway availability, but no write access or code execution (I:N), so practical severity is bounded by what internal or cloud-metadata endpoints the appliance can actually reach - landing it in the medium operational-priority band despite the critical base score. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing inside the conversion sandbox to break confinement and act with the privileges of the application service account, enabling reads or modifications of application data and configuration or disruption of the service. Exploitation is conditional: the attacker must first get code running inside the sandbox, typically by submitting a crafted document for conversion, and the CVSS vector (AV:L/PR:L/UI:N/S:C) confirms a local, low-privilege prerequisite with no user interaction once that foothold exists. No public exploit code has been identified at time of analysis, making this a genuine but conditional integrity and availability risk rather than a mass-exploitation threat; a vendor-released patch is documented in Kiteworks advisory GHSA-58j2-hj9r-c258.
Stored cross-site scripting in Kiteworks Core allows an administrator holding only a single narrowly scoped delegated permission to plant crafted content that later executes as JavaScript in the authenticated session of a higher-privileged System Administrator, enabling the lower-privileged attacker to escalate to full tenant administrative control and create a new administrative account. The flaw is tracked as CVE-2026-102126 with a vendor CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) and is rated high severity under CWE-79. Exploitation requires an authenticated admin with the delegated permission (PR:H) and depends on the victim System Administrator viewing the affected page (UI:R); no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
Improper authentication in Kiteworks Email Protection Gateway allows a remote, unauthenticated sender to make the gateway act against the Kiteworks platform as an identity it never verified, and to provision a new platform account for an identity the gateway does not already know - ultimately yielding control of a single platform account. Exploitation requires only network reachability to the gateway's message-processing path plus an inbound message asserting an identity; no credentials, privileges, or user interaction are involved (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and there is no evidence of active exploitation or public tooling; the vendor's CVSS 3.1 score is 7.5 with integrity-only impact, while independent assessment raises the confidentiality component to High (C:H/I:H/A:N) because account takeover implies read access to that account's data, though the realistic blast radius remains a single platform account rather than the underlying appliance.
Privilege escalation in Kiteworks Core allows a delegated administrator whose scope includes role changes to promote an account to full system-administrator through the user-provisioning interface, which fails to verify that the requester is entitled to grant the role being assigned (CWE-266). The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) confirms the flaw is network-reachable but requires high-privileged, delegated-admin credentials and no user interaction, so anonymous or ordinary-user accounts cannot exploit it and environments without scoped admin roles have no trust boundary to cross. No public exploit identified at time of analysis and no KEV listing; independent assessment rates this a genuine but low-to-medium operational priority rather than a high-urgency issue.
Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.
Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.
Privilege escalation in Kiteworks Core versions before 9.5.1 allows an authenticated delegated administrator holding only a single narrowly scoped administrative permission to obtain full system administrator privileges by abusing the administrative import function for integration credentials, which fails to verify that the requesting administrator is entitled to create the privileged credential being imported (CVE-2026-102132, CVSS 7.2 High). The attacker must already possess a valid delegated-admin account (PR:H), so this is an insider or lateral privilege-escalation issue rather than an unauthenticated internet-facing takeover, and no action by an existing system administrator is required for the escalation to succeed (UI:N). A vendor patch is available in Kiteworks Core 9.5.1; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthenticated attacker who can deliver an inbound message cause the gateway to issue crafted HTTP requests to internal or otherwise unintended network destinations, with the trigger occurring during the gateway's issuer-certificate retrieval step. With CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), a successful attack can disclose sensitive internal information reachable from the gateway's network position and/or disrupt gateway operation, but the practical impact is bounded by which internal services and metadata endpoints the gateway can reach and by whether any response data is reflected back to the attacker rather than being blind. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), though the combination of network reachability, no authentication, and no user interaction makes this a genuine priority within the email security gateway niche.
Deserialization of untrusted data in Kiteworks Core before 9.5.0 can escalate to remote code execution on the appliance, but only as a secondary, chained weakness rather than a standalone attack. The issue is not exploitable in isolation: an attacker must first obtain a way to influence the data that Core deserializes, which in practice means chaining a separate flaw (for example one of the file-write or injection issues in the same CISA CSAF batch, va-26-274-01) or leveraging an existing foothold. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and although the base score is 8.1, the local/config-adjacent reachability (AV:L), high attack complexity (AC:H) and the mandatory data-influence precondition materially lower real-world risk; the CVSS vector indicates no privileges are required (PR:N), but exploitation is not remotely self-contained.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Unauthenticated file write in Kiteworks Email Protection Gateway lets any attacker who can reach the appliance's administrative upload endpoint push files containing attacker-controlled content onto the underlying filesystem, because that handler performs no authentication or authorization check (CWE-306, CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). The directly reachable impact is integrity-only - no standalone code execution is achievable, since achieving RCE would require chaining a separate vulnerability to relocate the written file into an executable location. No public exploit code exists and no confirmed active exploitation was identified at time of analysis, so risk is genuine but bounded, concentrated on deployments that expose the management/upload interface to untrusted networks rather than those that firewall it to a management VLAN.
Stored cross-site scripting in Kiteworks Core before version 9.5.0 allows an authenticated user with only low privileges to submit content that executes arbitrary JavaScript in the browser session of any other user who later views it, potentially enabling full account takeover of higher-privileged users such as administrators. The issue scores 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N = High) because a successful attack crosses the browser privilege boundary into the victim's session, yielding high confidentiality and integrity impact while availability is unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is constrained by two prerequisites: the attacker must already hold a valid low-privileged account, and a second user must subsequently render the stored payload in the web UI.
Unauthenticated access to an internal service function in the Kiteworks Advanced Forms / Secure Data Forms component allows remote attackers who can reach the exposed endpoint to invoke a limited set of backend service operations on the Kiteworks platform. The flaw requires no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) and is bounded by design: the vendor states the reachable function cannot access user accounts, stored files, or form submissions, and exploitation is impossible if the component is not network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided; overall this represents a moderate real-world risk concentrated on internet-facing Kiteworks deployments that have the Advanced Forms functionality enabled.
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker to bind a certificate to another user's account, compromising the confidentiality and integrity of that account's encrypted mail. In deployments where certificate-based login is enabled, this can escalate to unauthorized account access; no public exploit was identified at time of analysis. The flaw maps to CWE-306 and carries a high assessed severity, though impact is bounded to encrypted-mail confidentiality and integrity unless certificate-based login is in use.
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist malicious JavaScript that executes in an administrator's browser session when the poisoned page is viewed. Successful exploitation could grant the attacker full administrative control, including creating new admin accounts, as reflected by the CVSS 9.3 score (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The primary limiting factor is the required user interaction-an administrator must actively view the affected page-and no public exploit identified at time of analysis.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
OS command injection in Kiteworks Core appliances running versions before 9.5.0 allows an authenticated administrator to upload a configuration package whose contents are not sufficiently validated, resulting in arbitrary operating-system command execution that may run with elevated privileges on the underlying appliance. The attack requires a valid administrator account with access to the configuration-package upload functionality in the administrative interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High), so the high-privilege prerequisite is the dominant constraint and the realistic scenario is a malicious, compromised, or coerced administrator rather than opportunistic unauthenticated remote exploitation; the assessed vector is internally consistent and concurred with. No public exploit code and no confirmed active exploitation were identified at time of analysis, and successful exploitation yields full compromise of confidentiality, integrity, and availability on the affected appliance.
Arbitrary file write in Kiteworks Core before 9.5.0 lets a holder of an existing administrative account steer the platform's administrative export feature to write files to any path on the underlying host, which can be chained into command execution on the appliance. The root cause is an improper restriction of a user-supplied file path (CWE-22), scored CVSS v3.1 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the flaw is not reachable by unauthenticated or standard users and command execution is a downstream consequence of the write rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis; the primary constraint on real-world risk is the high-privilege prerequisite.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. No public exploit code has been identified at time of analysis; the issue is nevertheless high priority given the unauthenticated network vector, with our independent assessment scoring integrity impact as Low (reflecting that state changes depend on which internal endpoint is reachable) rather than the published vector's High.
Unsafe reflection in Kiteworks Email Protection Gateway (all versions before 9.5.0) allows an authenticated administrator holding mail-rule configuration privileges to import a crafted rule configuration that causes the mail-processing pipeline to load and execute code outside the approved set of mail-processing components, resulting in code execution in the context of the mail-gateway service account (CVSS 3.1 base 7.2, High; vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind a high-privilege account (PR:H) with mail-rule import rights and requires no victim interaction, so the practical exposure is insider abuse or lateral movement after an attacker has already compromised such an administrative account; there is no unauthenticated or anonymous path. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor-supplied fix is version 9.5.0.
Improper privilege management in Kiteworks Core before 9.5.0 allows an authenticated administrative user who holds only limited, non-Sysadmin role-management permissions to grant another account full system-administrator (Sysadmin) rights that the grantor was never authorized to confer. The flaw sits in the role-assignment logic, which fails to constrain grantable privileges to the subset the granting administrator actually possesses, so a single delegated-admin session is enough to escalate a chosen account to the highest privilege level. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) the attack is network-reachable with no user interaction but requires an already-authenticated high-privilege session; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV). This is best characterized as a genuine but access-gated integrity risk whose real-world exposure depends on how many delegated administrators exist in a deployment and how tightly their role scopes are managed.
Stored cross-site scripting in Kiteworks Core allows an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when that victim previews the shared content, potentially enabling session compromise or account takeover. Affected deployments are Kiteworks Core versions before 9.5.0, and exploitation requires a valid platform account plus victim interaction with the preview rendering path. No public exploit code or CISA KEV listing has been identified at time of analysis, and the independent assessment classifies this as a moderate-priority, contingent-risk finding rather than an urgent one.
Unauthenticated server-side request forgery (SSRF) in Kiteworks Secure Data Forms before 9.5.0 allows remote attackers to force the server to issue arbitrary outbound network requests and read back the responses, exposing internal-only services, cloud metadata endpoints, and other network-restricted resources. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting the high confidentiality impact of reading internal responses rather than the vendor's C:N/I:H weighting. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
SQL injection in Kiteworks Secure Data Forms lets an authenticated user holding the FormBuilder role read and tamper with other tenants' form definitions and a subset of global configuration parameters in the Kiteworks Private Data Network prior to version 9.3.0. The flaw crosses the intended per-user data boundary via crafted input to the FormBuilder feature, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC rates exploitation as none.
Reflected cross-site scripting in Kiteworks Secure Data Forms (versions prior to 9.3.0) allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser after the victim is lured into clicking a crafted link. The CVSS 8.2 score is elevated by a changed scope (S:C) and high confidentiality impact, reflecting potential session theft or pivoting against the Kiteworks Private Data Network; no public exploit identified at time of analysis and not present in CISA KEV.
Reflected cross-site scripting in Kiteworks Secure Data Forms prior to version 9.3.0 allows external attackers to execute arbitrary JavaScript in a victim's browser session by tricking them into clicking a crafted link. The flaw carries a CVSS 8.2 due to scope change (S:C) and high confidentiality impact, but exploitation requires user interaction. At time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
A stored cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms that allows authenticated attackers to inject malicious scripts when modifying forms. Kiteworks Secure Data Forms versions prior to 9.2.1 are affected, enabling attackers with low-level privileges to execute arbitrary JavaScript in victims' browsers. There is no indication this vulnerability is actively exploited (not in CISA KEV), and no public proof-of-concept has been identified in available intelligence.
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to access unauthorized content within the private data network. With a CVSS score of 8.8 (High), an attacker with low-level authenticated access can potentially access, modify, or delete sensitive data they should not have permissions to view. No public proof-of-concept or active exploitation (KEV listing) has been reported at this time.
Kiteworks Email Protection Gateway prior to version 9.2.0 contains a stored cross-site scripting vulnerability in its configuration interface that allows authenticated administrators to inject malicious scripts executed against other users. An admin with high privileges can exploit this to compromise user sessions and data through the affected UI. No patch is currently available for this vulnerability.
An authenticated user of Kiteworks Core can abuse the file-request feature to send a request that appears to originate from a different, trusted account, because the server fails to verify that the requester is authorized to act on behalf of the identity they specify. Exploitation is gated by three conditions that substantially lower real-world risk: the attacker must hold a valid account (PR:L), the file-request feature must be enabled for the attacker's profile, and the targeted recipient must actively act on the spoofed request (UI:R). There is no memory corruption, code execution, or availability impact - the flaw only enables identity misrepresentation to solicit files or information. Consistent with an assessed CVSS of 4.6, a public exploit has not been identified at time of analysis and there is no confirmed active exploitation.
Kiteworks Core appliances that are mid-way through first-time activation expose an unauthenticated setup endpoint which enforces neither authentication (CWE-306) nor its intended state precondition, letting an unauthenticated, network-positioned attacker repeatedly re-trigger the privileged activation routine and drive the appliance into an incompletely configured state. The exposure is confined to the transient initial-activation window before the system is fully configured, so only newly deployed or re-provisioned appliances are at risk and the resulting impact is limited to setup integrity disruption - there is no confidentiality loss, no code execution, and no persistent takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV listing), and vendor-supplied patching is available; practical priority is consequently LOW-to-MEDIUM despite the network-reachable, unauthenticated vector.
Kiteworks Core deployments earlier than 9.5.0 allow an authenticated administrator to silently render a security-policy control ineffective by setting its configurable value outside the intended range, while the control continues to appear enabled in the administrative interface and audit log. The assessed impact is correspondingly limited - CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability impact - because exploitation requires full administrative privileges and produces a masking of enforcement rather than direct system compromise. No public exploit code was identified at time of analysis, and the realistic risk is confined to insider misuse or an already-compromised administrator session; a vendor patch is available.
Kiteworks Core versions below 9.5.1 fail to enforce which roles a shared folder's Manager is allowed to assign, so an authenticated user who already holds the Manager role on a folder can grant the Owner role on that same folder to themselves or to other members. The weakness works in a default configuration, but its impact is bounded: it is an escalation to Owner within that one folder and does not by itself confer tenant-wide or system-administrator rights. Rated CVSS 4.3 (integrity-only, low confidentiality and availability impact), with no public exploit code identified at time of analysis and no CISA KEV entry.
Kiteworks Core appliances running versions before 9.5.0 leave their setup interface reachable without authentication once initial configuration has completed, so any remote attacker with network access to that interface can read and modify a limited set of setup records - specifically the contact name and email address captured during provisioning. The flaw is state-dependent: authentication is enforced during first-run provisioning but the interface remains exposed afterward, and the exposed data is narrow, with no code execution, no broader configuration control, and no availability impact. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation; the practical risk is gated by whether the appliance's setup or management plane is reachable from untrusted networks.
Command injection in the optional repository-connector feature of Kiteworks Core allows an authenticated system administrator to append shell commands to a user-supplied path, resulting in code execution as the connector's service account and arbitrary file writes within that account's permissions. Only deployments running Kiteworks Core below 9.5.1 that have licensed and enabled the non-default repository connector are exposed, and successful exploitation additionally requires the appliance to be able to reach an attacker-controlled host over the network, as the injected command must pull or deliver content externally. Rated CVSS 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H); there is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so real-world risk is best characterised as LOW-to-MEDIUM despite the high-integrity/high-availability outcome, given the layered prerequisites of admin privilege, a separately licensed feature, and outbound egress.
Kiteworks Core versions before 9.5.1 fail to apply gateway-level API security controls to every request authenticated through the central authentication service, enabling an authenticated attacker to access REST API functionality on an unprotected path even with a revoked or signed-out session. This CWE-420 unprotected alternate channel yields low confidentiality and integrity impact (CVSS 5.4) and requires a valid authenticated session (PR:L). No public exploit code has been identified at time of analysis.
Code execution as the gateway service account can be achieved by a trusted party in a Kiteworks Email Protection Gateway cluster that has database replication enabled, via submission of a crafted serialized object that is deserialized without sufficient validation (CWE-502). The flaw is heavily gated: replication is disabled by default, so standard standalone deployments are not exposed, and the attacker must either control a trusted cluster peer or already hold administrative access to the appliance - meaning realistic exploitation is limited to insider abuse, post-compromise lateral movement, or a malicious administrator rather than opportunistic remote attack. All releases below 9.5.1 are affected, a vendor patch (9.5.1) is available, and no public exploit code or confirmed active exploitation was identified at time of analysis; the assessed CVSS is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity and high privileges required.
OS command execution on a second appliance node is possible in multi-node (clustered) Kiteworks Core deployments running versions below 9.5.1, but only for an attacker who has already achieved code execution on another node in the same cluster. An unvalidated value submitted through an internal cluster interface is written into the monitoring configuration of a peer node, where it can be interpreted as an OS command running under an unprivileged service account. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 3.1 score of 6.3 (AV:L/PR:L/S:C) reflects the strong prerequisites - local-adjacent access, existing low-privilege foothold, and a multi-node topology.
An authenticated administrator on Kiteworks Core can bypass server-side content validation for administrative file uploads, allowing storage of files with dangerous content. While this alone does not execute code, it could be leveraged in a chained attack with a separate vulnerability. Affected versions are prior to 9.5.1, and a vendor patch is available. The low CVSS score (4.1) reflects the high privilege requirement and complex bypass, and no public exploit has been identified.
Server-side request forgery in Kiteworks Core before 9.5.1 lets an authenticated administrator on a node with the separately licensed gateway role enabled supply a connector URL that the server fetches without adequately validating the URL scheme or destination, causing outbound requests to internal network services. Exploitation requires two prerequisites: a valid administrative session (CVSS PR:H) and an active optional gateway role, which is not a default configuration, and the resulting impact is constrained to limited confidentiality and integrity with no availability effect (CVSS 3.3, AC:H). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor has released a fixed version, 9.5.1, and the issue was reported through CISA's coordinated disclosure channel.
Authenticated users of Kiteworks Email Protection Gateway versions before 9.5.1 can read the subject, message body, and attachments of large file exchange packages they neither sent nor received. Exploitation requires a valid account (PR:L) and the optional large file exchange feature to be enabled and in use; no public exploit has been identified at time of analysis. The flaw is rated moderate severity (CVSS 6.5), with confidentiality-only impact and a vendor patch available in 9.5.1.
Insufficient verification of user-supplied data (CWE-345) in Kiteworks Core before version 9.5.1 allows an authenticated administrator to import a file whose header passes validation while its full contents remain forged or unverified, undermining the integrity of the imported data. The flaw is reachable over the network but requires high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), so only attackers holding a Kiteworks Core administrative account and access to the administrative import function can trigger it; there is no confidentiality or availability impact and no user interaction is needed. The CVSS base score of 4.9 (Medium) accurately reflects this constrained, integrity-only issue, and no public exploit code or confirmed active exploitation was identified at time of analysis. Kiteworks has released a fix in Core 9.5.1.
Two cluster-management operations in Kiteworks Core before 9.5.1 fail to validate attacker-supplied file paths, letting an attacker who already holds backend root on one node of a multi-node cluster write files as root onto another node and have them executed there. Exploitation is heavily gated: it is local-only (AV:L), requires pre-existing high privilege (PR:H, backend root), and depends on a software patch being simultaneously pending/staged on the target node to serve as the execution trigger - making this a lateral-movement and privilege-persistence primitive for an already-compromised cluster rather than an initial-access bug. This is a genuine but heavily gated post-compromise flaw, not a top-of-queue emergency; vendor patches are available and no public exploit code has been identified at time of analysis.
Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in version 9.5.1, and the issue is tracked as EUVD-2026-90268 with advisory GHSA-wwhf-5862-rjxq.
Authenticated file-write abuse in Kiteworks Email Protection Gateway (versions before 9.5.1) lets an administrator holding only limited, delegated permissions place attacker-controlled content at arbitrary filesystem locations writable by the EPG service account, exceeding the privileges that role is meant to grant. Successful exploitation allows tampering with application files and configuration, or disruption of service availability, but carries no confidentiality impact and does not by itself yield code execution. Exploitation requires a valid delegated-admin account and session (CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base score 6.5), and no public exploit identified at time of analysis.
Authenticated administrators on Kiteworks Core deployments earlier than 9.5.1 can abuse the administrative interface to make the server issue requests to, and interact with, internal network services that should not be reachable through that interface - a server-side request forgery (SSRF) style weakness with a scope change (S:C) that still carries a moderate 6.6 base score. Exploitation is gated behind high privileges (PR:H) and, as the vendor and our assessment both note, does not by itself achieve remote code execution; meaningful impact would require chaining with a separate flaw. No public exploit has been identified at time of analysis, but a vendor patch is available in Kiteworks Core 9.5.1, so the primary risk is to organizations that expose the admin plane to untrusted networks or allow unrestricted egress from the appliance.
Content injection in the Kiteworks Core PDF viewer in versions before 9.5.1 allows remote attackers to load an attacker-controlled document inside the application's own trusted domain, because a URL parameter used by the viewer is not sufficiently validated (CWE-601). Under the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (base 4.3), no authentication is required of the attacker, but exploitation depends on a victim clicking a crafted link and then trusting the rendered content; the resulting impact is limited to integrity/content spoofing (I:L) with no reading of Kiteworks data, no code execution, and no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the primary abuse case is raising the credibility of phishing that relies on links embedded in the displayed content. A vendor-released patch exists in Kiteworks Core 9.5.1.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms prior to version 9.3.0 enables access to other users' resource metadata through insufficient ownership authorization checks on resource identifiers. The vulnerability is classified CWE-639 and carries a CVSS score of 3.7 (Low), reflecting limited confidentiality impact (metadata only, no content) and high attack complexity. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms prior to version 9.3.0 allows any authenticated low-privileged user to modify form resources owned by other users by substituting controlled resource identifiers in API requests, bypassing ownership authorization checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the vulnerability is remotely exploitable with no complexity barrier beyond holding a valid account. No public exploit code and no CISA KEV listing identified at time of analysis; real-world risk is concentrated in multi-tenant Kiteworks deployments where data isolation between users is a security expectation.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms exposes a permission-modification vector for any authenticated user against resources owned by other users. All Kiteworks deployments running versions prior to 9.3.0 are affected, with the flaw rooted in missing ownership verification on resource authorization checks within the Secure Data Forms module. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the low attack complexity and network accessibility make it a credible insider or credential-compromise risk in multi-tenant environments where data isolation is a compliance requirement.
Stored cross-site scripting in Kiteworks Secure Data Forms allows authenticated low-privileged attackers to inject persistent malicious JavaScript that executes in other users' browser sessions. All Kiteworks releases prior to version 9.3.0 are affected, and the changed-scope CVSS modifier (S:C) confirms that injected scripts execute beyond the attacker's own session boundary, enabling session hijacking, credential theft, or unauthorized actions on behalf of victim users. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms allows authenticated low-privileged users to modify form resources owned by other users without authorization. All Kiteworks deployments running versions prior to 9.3.0 are affected, with the vulnerability rooted in missing server-side ownership validation on resource identifiers in the Secure Data Forms module. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; however, the low attack complexity and network accessibility make it a realistic lateral-privilege abuse path in multi-tenant Kiteworks environments.
Insecure Direct Object Reference in Kiteworks Secure Data Forms (all versions prior to 9.3.0) allows any authenticated low-privileged user to tamper with internal approval flow configurations belonging to other users by substituting resource identifiers in API requests. The root cause is missing server-side ownership validation on form configuration endpoints, meaning the application does not verify whether the requesting user owns the referenced resource. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, but the low attack complexity and lack of user interaction requirement make this straightforward to exploit once authenticated.
A session management vulnerability in Kiteworks Email Protection Gateway versions prior to 9.2.1 allows disabled user accounts to maintain active sessions indefinitely until natural session expiration. An attacker with a disabled account could continue accessing the platform and potentially modify data or system settings without re-authentication. While this vulnerability has not been reported as actively exploited (KEV status not listed as in-the-wild), it represents a direct bypass of account suspension controls and warrants prompt patching.
Kiteworks Secure Data Forms contains an unrestricted file upload vulnerability (CWE-434) that allows form managers to upload files with dangerous types due to missing input validation. An authenticated attacker with manager privileges can exploit this to upload malicious files, potentially leading to code execution or system compromise. The vulnerability affects all versions prior to 9.2.1, and a patch is available; no public exploit code has been confirmed, but the moderate CVSS score of 5.5 reflects the high integrity impact combined with the requirement for elevated privileges.
Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprotected transport of credentials over the network. This vulnerability affects all versions below 9.2.1 and enables attackers to intercept sensitive authentication material in transit, potentially leading to account compromise and unauthorized access to the private data network. No active exploitation in the wild (KEV) or public proof-of-concept has been reported, though the CVSS 6.5 score and high confidentiality impact indicate meaningful risk.
Kiteworks versions prior to 9.2.0 contain a DNS rebinding vulnerability that allows authenticated administrators to circumvent SSRF protections and access restricted internal services. An attacker with administrative privileges could exploit this misconfiguration to reach backend systems that should be isolated from external access. No patch is currently available for affected deployments.
Kiteworks versions prior to 9.2.0 lack proper file validation in their configuration upload functionality, allowing authenticated administrators to upload arbitrary files to the system. An attacker with administrative privileges could exploit this to introduce malicious or unauthorized file types, potentially compromising system integrity. A patch is available in version 9.2.0 and later.
Kiteworks versions prior to 9.2.0 suffer from a command injection vulnerability that permits authenticated users to redirect command output to arbitrary file locations, potentially enabling overwriting of critical system files and privilege escalation. The vulnerability requires high privileges and manual user interaction to exploit, resulting in a medium severity rating with limited real-world exploitation likelihood (EPSS 0.1%). No patch is currently available for affected installations.
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets a user who already has access to a shared folder abuse that folder's role-management function to improperly elevate another user's permissions on the share. The CVSS vector confirms the attacker must be authenticated (PR:L) and needs existing share access, with no user interaction required, and the impact is scoped to the targeted shared folder rather than the whole appliance. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.07% (22nd percentile); the vendor has released a fix in version 9.1.0.
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); a vendor patch is available in 9.5.0.
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attackers reach administrative functions simply by citing a valid administrator account identifier, without supplying the corresponding password or any token. Exploitation allows creation, modification, or deletion of internal users and managed domains and changes to security-feature configuration; deleting a managed domain also removes its user accounts and can lock legitimate administrators out of the gateway, consistent with the assessed vector's high integrity and availability impact and no confidentiality impact. The vendor has released fixed version 9.5.0, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV at time of analysis; the main gating factor is that the attacker must know or guess an existing administrative account reference and be able to reach the administrative service over the network.
Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and vendor-patched versions are available.
Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.
Local privilege escalation in Kiteworks Core lets an attacker who already holds code execution as an unprivileged backend service account invoke a privileged routine that mishandles attacker-influenced input, running arbitrary OS commands as root. The flaw requires a prior local foothold on the appliance - the CVSS vector (AV:L, PR:L, UI:N) confirms it cannot be reached directly over the network and demands an existing initial compromise or misconfiguration to obtain the service account. No public exploit code or active exploitation is identified at time of analysis, and the realistic risk is bounded by how easily that initial service-account access can be obtained on a given deployment; the vendor's advisory is GHSA-658c-86vw-g9hf.
Local privilege escalation in Kiteworks Core lets an attacker who already has code execution as an unprivileged backend service account on the appliance obtain root. A privileged, root-owned routine consumes a filesystem path that the lower-privileged service account can influence, so the attacker can steer that root operation into executing arbitrary commands with full privileges (CWE-59 link-following / unsafe path handling). The attack is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and is a second-stage primitive requiring an existing foothold; no public exploit was identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV), though the 7.8 severity and availability of a vendor advisory make prompt patching advisable.
Command injection in Kiteworks Core lets an authenticated administrator with elevated privileges run arbitrary operating-system commands as root on the affected appliance node, so an admin-only function can be turned into full host compromise. The flaw is remotely reachable and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N, base score 7.2), but PR:H is the dominant limiting factor: no unauthenticated or low-privilege path is indicated, so practical exploitation presupposes an insider or stolen high-privilege administrative credentials. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, keeping real-world urgency moderate and dependent on the value of the credentials required.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally stored passwords - including administrative accounts - by abusing insufficient parameter validation in the password reset workflow, which lets them bypass the emailed reset-link step and set a new password themselves before authenticating as that user. The flaw is classified CWE-640 (weak password recovery mechanism) and scores CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no non-default configuration are required; any internet-reachable Kiteworks Core instance hosting local-password accounts is exploitable. Independent assessment rates this a genuine top-priority issue rather than a high-score-but-low-risk case. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-authentication, low-complexity nature warrants urgent action.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
OS command execution in Kiteworks Core is possible when the remote-support capability is licensed and enabled and an authenticated System Administrator also possesses the key protecting submitted data, allowing that administrator to redirect the outbound support connection to an attacker-chosen destination that can then execute OS commands with local service account privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so exploitation requires high application privileges plus the additional key-possession condition, and deployments without remote support enabled are not exposed; there is no public exploit identified at time of analysis and no CISA KEV indication. The independent assessment rates real-world priority low-to-medium despite the 7.2 High base score.
Local privilege escalation in Kiteworks Core allows an attacker who already holds a shell under a low-privileged service account to elevate to root on the appliance, gaining complete control of the system and the sensitive content it brokers. The weakness is a link-following issue (CWE-59) in a root-privileged operation, reachable with local access as the service account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no non-default configuration, making it a realistic second-stage escalation after a separate initial-access compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVE is not associated with a KEV listing; the primary limiting factor is the prerequisite service-account foothold, while the primary risk is full root compromise of the appliance.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execution on one node of a clustered deployment to run operating system commands with elevated privileges on other nodes in the same cluster. The vulnerable function is not reachable from outside the cluster, so the attack path is confined to the internal cluster network and requires a pre-existing foothold on a cluster member; single-node deployments are not exposed. Rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change reflecting cross-node impact, and no public exploit identified at time of analysis.
The anonymous form-rendering endpoint in Kiteworks' Advanced Forms / Secure Data Forms component returns more information than a published form needs, letting anyone who knows or can guess a published form's web address retrieve the form owner's Kiteworks account profile (including personal details) plus portions of the deployment's configuration settings. No authentication or user interaction is required against a default deployment that serves published forms, and the exposed data does not include passwords, authentication tokens, or MFA secrets. Scoring is CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), driven entirely by confidentiality loss with a scope change since an unauthenticated viewer gains data belonging to a different security authority; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote attacker cause the gateway itself to send crafted requests to internal or otherwise unintended network destinations by simply sending an inbound message that triggers an online certificate status check. Because the request originates from the gateway's own network position, an attacker can potentially reach internal services that are not directly exposed, leading to sensitive information disclosure and, depending on reachable targets, disruption of gateway availability. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); exploitation is nevertheless trivially reachable since it requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 9.1), with realized impact bounded by the gateway's internal network position and egress restrictions.
Unauthenticated path traversal in the Kiteworks Core appliance setup interface allows an attacker who can reach that interface to write a file to any location writable by the appliance service account, enabling integrity compromise of the appliance or a denial-of-service condition that persists until an operator intervenes. The exposure is narrow: the setup interface is not reachable on a fully configured appliance in its default configuration, so exploitation is realistically limited to the transient provisioning window of a new appliance or a non-default configuration that leaves setup exposed, which is why AC:H applies despite PR:N and UI:N (CVSS 7.4). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw does not by itself provide code execution.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) to make the gateway fetch attacker-chosen URLs by embedding a crafted certificate revocation list reference in an inbound message. Successful exploitation yields disclosure of information reachable from the gateway's network position or disruption of gateway availability, but no write access or code execution (I:N), so practical severity is bounded by what internal or cloud-metadata endpoints the appliance can actually reach - landing it in the medium operational-priority band despite the critical base score. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing inside the conversion sandbox to break confinement and act with the privileges of the application service account, enabling reads or modifications of application data and configuration or disruption of the service. Exploitation is conditional: the attacker must first get code running inside the sandbox, typically by submitting a crafted document for conversion, and the CVSS vector (AV:L/PR:L/UI:N/S:C) confirms a local, low-privilege prerequisite with no user interaction once that foothold exists. No public exploit code has been identified at time of analysis, making this a genuine but conditional integrity and availability risk rather than a mass-exploitation threat; a vendor-released patch is documented in Kiteworks advisory GHSA-58j2-hj9r-c258.
Stored cross-site scripting in Kiteworks Core allows an administrator holding only a single narrowly scoped delegated permission to plant crafted content that later executes as JavaScript in the authenticated session of a higher-privileged System Administrator, enabling the lower-privileged attacker to escalate to full tenant administrative control and create a new administrative account. The flaw is tracked as CVE-2026-102126 with a vendor CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) and is rated high severity under CWE-79. Exploitation requires an authenticated admin with the delegated permission (PR:H) and depends on the victim System Administrator viewing the affected page (UI:R); no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
Improper authentication in Kiteworks Email Protection Gateway allows a remote, unauthenticated sender to make the gateway act against the Kiteworks platform as an identity it never verified, and to provision a new platform account for an identity the gateway does not already know - ultimately yielding control of a single platform account. Exploitation requires only network reachability to the gateway's message-processing path plus an inbound message asserting an identity; no credentials, privileges, or user interaction are involved (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and there is no evidence of active exploitation or public tooling; the vendor's CVSS 3.1 score is 7.5 with integrity-only impact, while independent assessment raises the confidentiality component to High (C:H/I:H/A:N) because account takeover implies read access to that account's data, though the realistic blast radius remains a single platform account rather than the underlying appliance.
Privilege escalation in Kiteworks Core allows a delegated administrator whose scope includes role changes to promote an account to full system-administrator through the user-provisioning interface, which fails to verify that the requester is entitled to grant the role being assigned (CWE-266). The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) confirms the flaw is network-reachable but requires high-privileged, delegated-admin credentials and no user interaction, so anonymous or ordinary-user accounts cannot exploit it and environments without scoped admin roles have no trust boundary to cross. No public exploit identified at time of analysis and no KEV listing; independent assessment rates this a genuine but low-to-medium operational priority rather than a high-urgency issue.
Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.
Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.
Privilege escalation in Kiteworks Core versions before 9.5.1 allows an authenticated delegated administrator holding only a single narrowly scoped administrative permission to obtain full system administrator privileges by abusing the administrative import function for integration credentials, which fails to verify that the requesting administrator is entitled to create the privileged credential being imported (CVE-2026-102132, CVSS 7.2 High). The attacker must already possess a valid delegated-admin account (PR:H), so this is an insider or lateral privilege-escalation issue rather than an unauthenticated internet-facing takeover, and no action by an existing system administrator is required for the escalation to succeed (UI:N). A vendor patch is available in Kiteworks Core 9.5.1; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthenticated attacker who can deliver an inbound message cause the gateway to issue crafted HTTP requests to internal or otherwise unintended network destinations, with the trigger occurring during the gateway's issuer-certificate retrieval step. With CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), a successful attack can disclose sensitive internal information reachable from the gateway's network position and/or disrupt gateway operation, but the practical impact is bounded by which internal services and metadata endpoints the gateway can reach and by whether any response data is reflected back to the attacker rather than being blind. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), though the combination of network reachability, no authentication, and no user interaction makes this a genuine priority within the email security gateway niche.
Deserialization of untrusted data in Kiteworks Core before 9.5.0 can escalate to remote code execution on the appliance, but only as a secondary, chained weakness rather than a standalone attack. The issue is not exploitable in isolation: an attacker must first obtain a way to influence the data that Core deserializes, which in practice means chaining a separate flaw (for example one of the file-write or injection issues in the same CISA CSAF batch, va-26-274-01) or leveraging an existing foothold. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and although the base score is 8.1, the local/config-adjacent reachability (AV:L), high attack complexity (AC:H) and the mandatory data-influence precondition materially lower real-world risk; the CVSS vector indicates no privileges are required (PR:N), but exploitation is not remotely self-contained.
Server-side template injection in the Kiteworks Core appliance allows an authenticated System Administrator to store a crafted system-notification template whose embedded template-engine expressions are evaluated when the notification is next rendered, resulting in operating-system command execution on the appliance. Exploitation requires a high-privileged admin account (CVSS vector PR:H, UI:N) and has a timing dependency because the payload only fires when the affected notification is triggered, making this a malicious-insider or compromised-admin scenario rather than a perimeter-reachable RCE. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-assigned CVSS 3.1 score of 7.2 (C:H/I:H/A:H) reflects full compromise of confidentiality, integrity, and availability once the template is rendered.
Unauthenticated file write in Kiteworks Email Protection Gateway lets any attacker who can reach the appliance's administrative upload endpoint push files containing attacker-controlled content onto the underlying filesystem, because that handler performs no authentication or authorization check (CWE-306, CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). The directly reachable impact is integrity-only - no standalone code execution is achievable, since achieving RCE would require chaining a separate vulnerability to relocate the written file into an executable location. No public exploit code exists and no confirmed active exploitation was identified at time of analysis, so risk is genuine but bounded, concentrated on deployments that expose the management/upload interface to untrusted networks rather than those that firewall it to a management VLAN.
Stored cross-site scripting in Kiteworks Core before version 9.5.0 allows an authenticated user with only low privileges to submit content that executes arbitrary JavaScript in the browser session of any other user who later views it, potentially enabling full account takeover of higher-privileged users such as administrators. The issue scores 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N = High) because a successful attack crosses the browser privilege boundary into the victim's session, yielding high confidentiality and integrity impact while availability is unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is constrained by two prerequisites: the attacker must already hold a valid low-privileged account, and a second user must subsequently render the stored payload in the web UI.
Unauthenticated access to an internal service function in the Kiteworks Advanced Forms / Secure Data Forms component allows remote attackers who can reach the exposed endpoint to invoke a limited set of backend service operations on the Kiteworks platform. The flaw requires no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) and is bounded by design: the vendor states the reachable function cannot access user accounts, stored files, or form submissions, and exploitation is impossible if the component is not network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided; overall this represents a moderate real-world risk concentrated on internet-facing Kiteworks deployments that have the Advanced Forms functionality enabled.
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker to bind a certificate to another user's account, compromising the confidentiality and integrity of that account's encrypted mail. In deployments where certificate-based login is enabled, this can escalate to unauthorized account access; no public exploit was identified at time of analysis. The flaw maps to CWE-306 and carries a high assessed severity, though impact is bounded to encrypted-mail confidentiality and integrity unless certificate-based login is in use.
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist malicious JavaScript that executes in an administrator's browser session when the poisoned page is viewed. Successful exploitation could grant the attacker full administrative control, including creating new admin accounts, as reflected by the CVSS 9.3 score (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). The primary limiting factor is the required user interaction-an administrator must actively view the affected page-and no public exploit identified at time of analysis.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
OS command injection in Kiteworks Core appliances running versions before 9.5.0 allows an authenticated administrator to upload a configuration package whose contents are not sufficiently validated, resulting in arbitrary operating-system command execution that may run with elevated privileges on the underlying appliance. The attack requires a valid administrator account with access to the configuration-package upload functionality in the administrative interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High), so the high-privilege prerequisite is the dominant constraint and the realistic scenario is a malicious, compromised, or coerced administrator rather than opportunistic unauthenticated remote exploitation; the assessed vector is internally consistent and concurred with. No public exploit code and no confirmed active exploitation were identified at time of analysis, and successful exploitation yields full compromise of confidentiality, integrity, and availability on the affected appliance.
Arbitrary file write in Kiteworks Core before 9.5.0 lets a holder of an existing administrative account steer the platform's administrative export feature to write files to any path on the underlying host, which can be chained into command execution on the appliance. The root cause is an improper restriction of a user-supplied file path (CWE-22), scored CVSS v3.1 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the flaw is not reachable by unauthenticated or standard users and command execution is a downstream consequence of the write rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis; the primary constraint on real-world risk is the high-privilege prerequisite.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. No public exploit code has been identified at time of analysis; the issue is nevertheless high priority given the unauthenticated network vector, with our independent assessment scoring integrity impact as Low (reflecting that state changes depend on which internal endpoint is reachable) rather than the published vector's High.
Unsafe reflection in Kiteworks Email Protection Gateway (all versions before 9.5.0) allows an authenticated administrator holding mail-rule configuration privileges to import a crafted rule configuration that causes the mail-processing pipeline to load and execute code outside the approved set of mail-processing components, resulting in code execution in the context of the mail-gateway service account (CVSS 3.1 base 7.2, High; vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind a high-privilege account (PR:H) with mail-rule import rights and requires no victim interaction, so the practical exposure is insider abuse or lateral movement after an attacker has already compromised such an administrative account; there is no unauthenticated or anonymous path. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor-supplied fix is version 9.5.0.
Improper privilege management in Kiteworks Core before 9.5.0 allows an authenticated administrative user who holds only limited, non-Sysadmin role-management permissions to grant another account full system-administrator (Sysadmin) rights that the grantor was never authorized to confer. The flaw sits in the role-assignment logic, which fails to constrain grantable privileges to the subset the granting administrator actually possesses, so a single delegated-admin session is enough to escalate a chosen account to the highest privilege level. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) the attack is network-reachable with no user interaction but requires an already-authenticated high-privilege session; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV). This is best characterized as a genuine but access-gated integrity risk whose real-world exposure depends on how many delegated administrators exist in a deployment and how tightly their role scopes are managed.
Stored cross-site scripting in Kiteworks Core allows an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when that victim previews the shared content, potentially enabling session compromise or account takeover. Affected deployments are Kiteworks Core versions before 9.5.0, and exploitation requires a valid platform account plus victim interaction with the preview rendering path. No public exploit code or CISA KEV listing has been identified at time of analysis, and the independent assessment classifies this as a moderate-priority, contingent-risk finding rather than an urgent one.
Unauthenticated server-side request forgery (SSRF) in Kiteworks Secure Data Forms before 9.5.0 allows remote attackers to force the server to issue arbitrary outbound network requests and read back the responses, exposing internal-only services, cloud metadata endpoints, and other network-restricted resources. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting the high confidentiality impact of reading internal responses rather than the vendor's C:N/I:H weighting. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
SQL injection in Kiteworks Secure Data Forms lets an authenticated user holding the FormBuilder role read and tamper with other tenants' form definitions and a subset of global configuration parameters in the Kiteworks Private Data Network prior to version 9.3.0. The flaw crosses the intended per-user data boundary via crafted input to the FormBuilder feature, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC rates exploitation as none.
Reflected cross-site scripting in Kiteworks Secure Data Forms (versions prior to 9.3.0) allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser after the victim is lured into clicking a crafted link. The CVSS 8.2 score is elevated by a changed scope (S:C) and high confidentiality impact, reflecting potential session theft or pivoting against the Kiteworks Private Data Network; no public exploit identified at time of analysis and not present in CISA KEV.
Reflected cross-site scripting in Kiteworks Secure Data Forms prior to version 9.3.0 allows external attackers to execute arbitrary JavaScript in a victim's browser session by tricking them into clicking a crafted link. The flaw carries a CVSS 8.2 due to scope change (S:C) and high confidentiality impact, but exploitation requires user interaction. At time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
A stored cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms that allows authenticated attackers to inject malicious scripts when modifying forms. Kiteworks Secure Data Forms versions prior to 9.2.1 are affected, enabling attackers with low-level privileges to execute arbitrary JavaScript in victims' browsers. There is no indication this vulnerability is actively exploited (not in CISA KEV), and no public proof-of-concept has been identified in available intelligence.
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to access unauthorized content within the private data network. With a CVSS score of 8.8 (High), an attacker with low-level authenticated access can potentially access, modify, or delete sensitive data they should not have permissions to view. No public proof-of-concept or active exploitation (KEV listing) has been reported at this time.
Kiteworks Email Protection Gateway prior to version 9.2.0 contains a stored cross-site scripting vulnerability in its configuration interface that allows authenticated administrators to inject malicious scripts executed against other users. An admin with high privileges can exploit this to compromise user sessions and data through the affected UI. No patch is currently available for this vulnerability.
An authenticated user of Kiteworks Core can abuse the file-request feature to send a request that appears to originate from a different, trusted account, because the server fails to verify that the requester is authorized to act on behalf of the identity they specify. Exploitation is gated by three conditions that substantially lower real-world risk: the attacker must hold a valid account (PR:L), the file-request feature must be enabled for the attacker's profile, and the targeted recipient must actively act on the spoofed request (UI:R). There is no memory corruption, code execution, or availability impact - the flaw only enables identity misrepresentation to solicit files or information. Consistent with an assessed CVSS of 4.6, a public exploit has not been identified at time of analysis and there is no confirmed active exploitation.
Kiteworks Core appliances that are mid-way through first-time activation expose an unauthenticated setup endpoint which enforces neither authentication (CWE-306) nor its intended state precondition, letting an unauthenticated, network-positioned attacker repeatedly re-trigger the privileged activation routine and drive the appliance into an incompletely configured state. The exposure is confined to the transient initial-activation window before the system is fully configured, so only newly deployed or re-provisioned appliances are at risk and the resulting impact is limited to setup integrity disruption - there is no confidentiality loss, no code execution, and no persistent takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV listing), and vendor-supplied patching is available; practical priority is consequently LOW-to-MEDIUM despite the network-reachable, unauthenticated vector.
Kiteworks Core deployments earlier than 9.5.0 allow an authenticated administrator to silently render a security-policy control ineffective by setting its configurable value outside the intended range, while the control continues to appear enabled in the administrative interface and audit log. The assessed impact is correspondingly limited - CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability impact - because exploitation requires full administrative privileges and produces a masking of enforcement rather than direct system compromise. No public exploit code was identified at time of analysis, and the realistic risk is confined to insider misuse or an already-compromised administrator session; a vendor patch is available.
Kiteworks Core versions below 9.5.1 fail to enforce which roles a shared folder's Manager is allowed to assign, so an authenticated user who already holds the Manager role on a folder can grant the Owner role on that same folder to themselves or to other members. The weakness works in a default configuration, but its impact is bounded: it is an escalation to Owner within that one folder and does not by itself confer tenant-wide or system-administrator rights. Rated CVSS 4.3 (integrity-only, low confidentiality and availability impact), with no public exploit code identified at time of analysis and no CISA KEV entry.
Kiteworks Core appliances running versions before 9.5.0 leave their setup interface reachable without authentication once initial configuration has completed, so any remote attacker with network access to that interface can read and modify a limited set of setup records - specifically the contact name and email address captured during provisioning. The flaw is state-dependent: authentication is enforced during first-run provisioning but the interface remains exposed afterward, and the exposed data is narrow, with no code execution, no broader configuration control, and no availability impact. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation; the practical risk is gated by whether the appliance's setup or management plane is reachable from untrusted networks.
Command injection in the optional repository-connector feature of Kiteworks Core allows an authenticated system administrator to append shell commands to a user-supplied path, resulting in code execution as the connector's service account and arbitrary file writes within that account's permissions. Only deployments running Kiteworks Core below 9.5.1 that have licensed and enabled the non-default repository connector are exposed, and successful exploitation additionally requires the appliance to be able to reach an attacker-controlled host over the network, as the injected command must pull or deliver content externally. Rated CVSS 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H); there is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so real-world risk is best characterised as LOW-to-MEDIUM despite the high-integrity/high-availability outcome, given the layered prerequisites of admin privilege, a separately licensed feature, and outbound egress.
Kiteworks Core versions before 9.5.1 fail to apply gateway-level API security controls to every request authenticated through the central authentication service, enabling an authenticated attacker to access REST API functionality on an unprotected path even with a revoked or signed-out session. This CWE-420 unprotected alternate channel yields low confidentiality and integrity impact (CVSS 5.4) and requires a valid authenticated session (PR:L). No public exploit code has been identified at time of analysis.
Code execution as the gateway service account can be achieved by a trusted party in a Kiteworks Email Protection Gateway cluster that has database replication enabled, via submission of a crafted serialized object that is deserialized without sufficient validation (CWE-502). The flaw is heavily gated: replication is disabled by default, so standard standalone deployments are not exposed, and the attacker must either control a trusted cluster peer or already hold administrative access to the appliance - meaning realistic exploitation is limited to insider abuse, post-compromise lateral movement, or a malicious administrator rather than opportunistic remote attack. All releases below 9.5.1 are affected, a vendor patch (9.5.1) is available, and no public exploit code or confirmed active exploitation was identified at time of analysis; the assessed CVSS is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity and high privileges required.
OS command execution on a second appliance node is possible in multi-node (clustered) Kiteworks Core deployments running versions below 9.5.1, but only for an attacker who has already achieved code execution on another node in the same cluster. An unvalidated value submitted through an internal cluster interface is written into the monitoring configuration of a peer node, where it can be interpreted as an OS command running under an unprivileged service account. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 3.1 score of 6.3 (AV:L/PR:L/S:C) reflects the strong prerequisites - local-adjacent access, existing low-privilege foothold, and a multi-node topology.
An authenticated administrator on Kiteworks Core can bypass server-side content validation for administrative file uploads, allowing storage of files with dangerous content. While this alone does not execute code, it could be leveraged in a chained attack with a separate vulnerability. Affected versions are prior to 9.5.1, and a vendor patch is available. The low CVSS score (4.1) reflects the high privilege requirement and complex bypass, and no public exploit has been identified.
Server-side request forgery in Kiteworks Core before 9.5.1 lets an authenticated administrator on a node with the separately licensed gateway role enabled supply a connector URL that the server fetches without adequately validating the URL scheme or destination, causing outbound requests to internal network services. Exploitation requires two prerequisites: a valid administrative session (CVSS PR:H) and an active optional gateway role, which is not a default configuration, and the resulting impact is constrained to limited confidentiality and integrity with no availability effect (CVSS 3.3, AC:H). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor has released a fixed version, 9.5.1, and the issue was reported through CISA's coordinated disclosure channel.
Authenticated users of Kiteworks Email Protection Gateway versions before 9.5.1 can read the subject, message body, and attachments of large file exchange packages they neither sent nor received. Exploitation requires a valid account (PR:L) and the optional large file exchange feature to be enabled and in use; no public exploit has been identified at time of analysis. The flaw is rated moderate severity (CVSS 6.5), with confidentiality-only impact and a vendor patch available in 9.5.1.
Insufficient verification of user-supplied data (CWE-345) in Kiteworks Core before version 9.5.1 allows an authenticated administrator to import a file whose header passes validation while its full contents remain forged or unverified, undermining the integrity of the imported data. The flaw is reachable over the network but requires high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), so only attackers holding a Kiteworks Core administrative account and access to the administrative import function can trigger it; there is no confidentiality or availability impact and no user interaction is needed. The CVSS base score of 4.9 (Medium) accurately reflects this constrained, integrity-only issue, and no public exploit code or confirmed active exploitation was identified at time of analysis. Kiteworks has released a fix in Core 9.5.1.
Two cluster-management operations in Kiteworks Core before 9.5.1 fail to validate attacker-supplied file paths, letting an attacker who already holds backend root on one node of a multi-node cluster write files as root onto another node and have them executed there. Exploitation is heavily gated: it is local-only (AV:L), requires pre-existing high privilege (PR:H, backend root), and depends on a software patch being simultaneously pending/staged on the target node to serve as the execution trigger - making this a lateral-movement and privilege-persistence primitive for an already-compromised cluster rather than an initial-access bug. This is a genuine but heavily gated post-compromise flaw, not a top-of-queue emergency; vendor patches are available and no public exploit code has been identified at time of analysis.
Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in version 9.5.1, and the issue is tracked as EUVD-2026-90268 with advisory GHSA-wwhf-5862-rjxq.
Authenticated file-write abuse in Kiteworks Email Protection Gateway (versions before 9.5.1) lets an administrator holding only limited, delegated permissions place attacker-controlled content at arbitrary filesystem locations writable by the EPG service account, exceeding the privileges that role is meant to grant. Successful exploitation allows tampering with application files and configuration, or disruption of service availability, but carries no confidentiality impact and does not by itself yield code execution. Exploitation requires a valid delegated-admin account and session (CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base score 6.5), and no public exploit identified at time of analysis.
Authenticated administrators on Kiteworks Core deployments earlier than 9.5.1 can abuse the administrative interface to make the server issue requests to, and interact with, internal network services that should not be reachable through that interface - a server-side request forgery (SSRF) style weakness with a scope change (S:C) that still carries a moderate 6.6 base score. Exploitation is gated behind high privileges (PR:H) and, as the vendor and our assessment both note, does not by itself achieve remote code execution; meaningful impact would require chaining with a separate flaw. No public exploit has been identified at time of analysis, but a vendor patch is available in Kiteworks Core 9.5.1, so the primary risk is to organizations that expose the admin plane to untrusted networks or allow unrestricted egress from the appliance.
Content injection in the Kiteworks Core PDF viewer in versions before 9.5.1 allows remote attackers to load an attacker-controlled document inside the application's own trusted domain, because a URL parameter used by the viewer is not sufficiently validated (CWE-601). Under the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (base 4.3), no authentication is required of the attacker, but exploitation depends on a victim clicking a crafted link and then trusting the rendered content; the resulting impact is limited to integrity/content spoofing (I:L) with no reading of Kiteworks data, no code execution, and no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the primary abuse case is raising the credibility of phishing that relies on links embedded in the displayed content. A vendor-released patch exists in Kiteworks Core 9.5.1.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms prior to version 9.3.0 enables access to other users' resource metadata through insufficient ownership authorization checks on resource identifiers. The vulnerability is classified CWE-639 and carries a CVSS score of 3.7 (Low), reflecting limited confidentiality impact (metadata only, no content) and high attack complexity. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms prior to version 9.3.0 allows any authenticated low-privileged user to modify form resources owned by other users by substituting controlled resource identifiers in API requests, bypassing ownership authorization checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the vulnerability is remotely exploitable with no complexity barrier beyond holding a valid account. No public exploit code and no CISA KEV listing identified at time of analysis; real-world risk is concentrated in multi-tenant Kiteworks deployments where data isolation between users is a security expectation.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms exposes a permission-modification vector for any authenticated user against resources owned by other users. All Kiteworks deployments running versions prior to 9.3.0 are affected, with the flaw rooted in missing ownership verification on resource authorization checks within the Secure Data Forms module. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the low attack complexity and network accessibility make it a credible insider or credential-compromise risk in multi-tenant environments where data isolation is a compliance requirement.
Stored cross-site scripting in Kiteworks Secure Data Forms allows authenticated low-privileged attackers to inject persistent malicious JavaScript that executes in other users' browser sessions. All Kiteworks releases prior to version 9.3.0 are affected, and the changed-scope CVSS modifier (S:C) confirms that injected scripts execute beyond the attacker's own session boundary, enabling session hijacking, credential theft, or unauthorized actions on behalf of victim users. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms allows authenticated low-privileged users to modify form resources owned by other users without authorization. All Kiteworks deployments running versions prior to 9.3.0 are affected, with the vulnerability rooted in missing server-side ownership validation on resource identifiers in the Secure Data Forms module. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; however, the low attack complexity and network accessibility make it a realistic lateral-privilege abuse path in multi-tenant Kiteworks environments.
Insecure Direct Object Reference in Kiteworks Secure Data Forms (all versions prior to 9.3.0) allows any authenticated low-privileged user to tamper with internal approval flow configurations belonging to other users by substituting resource identifiers in API requests. The root cause is missing server-side ownership validation on form configuration endpoints, meaning the application does not verify whether the requesting user owns the referenced resource. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, but the low attack complexity and lack of user interaction requirement make this straightforward to exploit once authenticated.
A session management vulnerability in Kiteworks Email Protection Gateway versions prior to 9.2.1 allows disabled user accounts to maintain active sessions indefinitely until natural session expiration. An attacker with a disabled account could continue accessing the platform and potentially modify data or system settings without re-authentication. While this vulnerability has not been reported as actively exploited (KEV status not listed as in-the-wild), it represents a direct bypass of account suspension controls and warrants prompt patching.
Kiteworks Secure Data Forms contains an unrestricted file upload vulnerability (CWE-434) that allows form managers to upload files with dangerous types due to missing input validation. An authenticated attacker with manager privileges can exploit this to upload malicious files, potentially leading to code execution or system compromise. The vulnerability affects all versions prior to 9.2.1, and a patch is available; no public exploit code has been confirmed, but the moderate CVSS score of 5.5 reflects the high integrity impact combined with the requirement for elevated privileges.
Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprotected transport of credentials over the network. This vulnerability affects all versions below 9.2.1 and enables attackers to intercept sensitive authentication material in transit, potentially leading to account compromise and unauthorized access to the private data network. No active exploitation in the wild (KEV) or public proof-of-concept has been reported, though the CVSS 6.5 score and high confidentiality impact indicate meaningful risk.
Kiteworks versions prior to 9.2.0 contain a DNS rebinding vulnerability that allows authenticated administrators to circumvent SSRF protections and access restricted internal services. An attacker with administrative privileges could exploit this misconfiguration to reach backend systems that should be isolated from external access. No patch is currently available for affected deployments.
Kiteworks versions prior to 9.2.0 lack proper file validation in their configuration upload functionality, allowing authenticated administrators to upload arbitrary files to the system. An attacker with administrative privileges could exploit this to introduce malicious or unauthorized file types, potentially compromising system integrity. A patch is available in version 9.2.0 and later.
Kiteworks versions prior to 9.2.0 suffer from a command injection vulnerability that permits authenticated users to redirect command output to arbitrary file locations, potentially enabling overwriting of critical system files and privilege escalation. The vulnerability requires high privileges and manual user interaction to exploit, resulting in a medium severity rating with limited real-world exploitation likelihood (EPSS 0.1%). No patch is currently available for affected installations.
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets a user who already has access to a shared folder abuse that folder's role-management function to improperly elevate another user's permissions on the share. The CVSS vector confirms the attacker must be authenticated (PR:L) and needs existing share access, with no user interaction required, and the impact is scoped to the targeted shared folder rather than the whole appliance. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.07% (22nd percentile); the vendor has released a fix in version 9.1.0.
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.