Kiteworks vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-102150 A function in the Kiteworks Advanced Forms component was reachable without authentication.High 7.2 · Sep 30, 2026
• CVE-2026-102149 Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to.Critical 9.4 · Sep 30, 2026
• CVE-2026-102147 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JaCritical 9.3 · Sep 30, 2026
• CVE-2026-102143 An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handlHigh 7.5 · Sep 30, 2026
• CVE-2026-102142 A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body.High 7.2 · Sep 30, 2026
• CVE-2026-102132 An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credentiaHigh 7.2 · Sep 30, 2026
• CVE-2026-102131 Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied.High 7.2 · Sep 30, 2026
• CVE-2026-102130 Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the applicatioHigh 7.2 · Sep 30, 2026
• CVE-2026-102129 A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned.High 7.2 · Sep 30, 2026
• CVE-2026-102128 An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authHigh 7.5 · Sep 30, 2026
• CVE-2026-102127 An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references.High 7 · Sep 30, 2026
• CVE-2026-102126 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to storeHigh 8.1 · Sep 30, 2026
• CVE-2026-102125 The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.High 8.8 · Sep 30, 2026
• CVE-2026-102123 A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to writHigh 7.4 · Sep 30, 2026
• CVE-2026-102121 A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, bHigh 8.6 · Sep 30, 2026
• CVE-2026-102120 A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deHigh 8.8 · Sep 30, 2026
• CVE-2026-102119 A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outsidHigh 7.2 · Sep 30, 2026
• CVE-2026-102118 A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalateHigh 7.8 · Sep 30, 2026
• CVE-2026-102117 On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submHigh 7.2 · Sep 30, 2026
• CVE-2026-102116 -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the appHigh 7.2 · Sep 30, 2026
• CVE-2026-102115 Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow.Critical 9.8 · Sep 30, 2026
• CVE-2026-102114 A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root High 7.2 · Sep 30, 2026
• CVE-2026-102113 A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on High 7.8 · Sep 30, 2026
• CVE-2026-102112 A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on High 7.8 · Sep 30, 2026
• CVE-2026-102109 A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated iHigh 7.1 · Sep 30, 2026