CVE-2026-102090

Kiteworks Core content injection

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-23638

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24751

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24752

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24753

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24754

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24755

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24756

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24761

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24782

Kiteworks Secure Data Forms has a SQL Injection vulnerability

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-28271

Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Security-advisories

CVE-2026-28269

Kiteworks Core has an OS Command Injection

Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Security-advisories

CVE-2026-28272

Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Security-advisories

CVE-2026-28270

Kiteworks Core has an Unrestricted Upload of File with Dangerous Type

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Security-advisories

CVE-2026-23514

Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management

Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-24750

Kiteworks Secure Data Forms vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-23635

Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-23636

Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-29092

Kiteworks Email Protection Gateway has an Insufficient Session Expiration

Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Kiteworks Email Protection Gateway

CVE-2025-53939

Kiteworks Core is vulnerable to Improper Input Validation

Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Kiteworks