CVE-2026-102114

A command injection vulnerability exists in Kiteworks that allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges. No specific r...

CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...

CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...

CVE-2026-102115

Kiteworks Core is vulnerable to an authentication bypass in its password reset workflow due to insufficient validation of a submitted parameter. An unauthenticated attacker who possesses a user's email address can reset the account's password without needing access to the emailed reset link. This...

CVE-2026-102116 Kiteworks Email Protection Gateway Path Traversal

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account...

CVE-2026-102116

The Kiteworks Email Protection Gateway is vulnerable to a path traversal weakness. An authenticated administrator could potentially write a file outside its intended location and trigger the application to execute it. This could lead to remote code execution (RCE) under the privileges of the unde...

CVE-2026-102116 Kiteworks Email Protection Gateway Path Traversal

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account...

CVE-2026-102117 Kiteworks Core Remote Code Execution

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...

CVE-2026-102117 Kiteworks Core Remote Code Execution

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...

CVE-2026-102117

The Kiteworks Core platform is vulnerable to Remote Code Execution (RCE) when the remote-support capability is licensed and enabled. An authenticated System Administrator who possesses the key protecting the submitted data can redirect the system's outbound support connection to a destination of ...

CVE-2026-102118

A local privilege escalation vulnerability exists in Kiteworks Core versions prior to 9.5.0 . An attacker who already possesses a shell under a low-privileged service account can exploit this flaw to escalate their privileges to root on the appliance. The documents do not provide specific technic...

CVE-2026-102118 Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance...

CVE-2026-102118 Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance...

CVE-2026-102119 Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

CVE-2026-102119 Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

CVE-2026-102119

A path traversal weakness exists in an optional, non-default administrative feature of the Kiteworks Email Protection Gateway . This flaw allows an authenticated administrator to move files to unintended locations outside the designated directory, which could potentially lead to arbitrary code ex...

CVE-2026-102120

A privilege escalation vulnerability exists in Kiteworks due to insufficient input validation within an internal cluster management function. This flaw allows an attacker who already has code execution on one node of a clustered Kiteworks deployment to execute operating system commands with eleva...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102121 Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve th...