CVE-2026-102089

The Kiteworks Email Protection Gateway (versions before 9.5.0) is vulnerable to a path traversal weakness within an administrative import function. This flaw allows an authenticated administrator to write files to arbitrary locations on the server, which could potentially be leveraged to achieve ...

CVE-2026-102116

The Kiteworks Email Protection Gateway is vulnerable to a path traversal weakness. An authenticated administrator could potentially write a file outside its intended location and trigger the application to execute it. This could lead to remote code execution (RCE) under the privileges of the unde...

CVE-2026-102118

A local privilege escalation vulnerability exists in Kiteworks Core versions prior to 9.5.0 . An attacker who already possesses a shell under a low-privileged service account can exploit this flaw to escalate their privileges to root on the appliance. The documents do not provide specific technic...

CVE-2026-102109

A SQL injection vulnerability exists in Kiteworks Secure Data Forms . The root cause is the improper sanitization of a value derived from an authenticated user's stored account data when incorporated into a database query. Exploitation requires an authenticated session and is only applicable to d...

CVE-2026-102112

A privilege escalation vulnerability exists in Kiteworks , where an attacker with existing local access and code execution as an unprivileged backend service account on the appliance can escalate to root privileges. This allows the attacker to run arbitrary commands with the highest privileges. T...

CVE-2026-102134

The Kiteworks Core platform contains a vulnerability where gateway-level API security controls are not consistently applied to all requests authenticated via the central authentication service. Specifically, an authenticated user can access REST API functionality through request paths that bypass...

CVE-2026-102090

Kiteworks Core versions prior to 9.5.1 are vulnerable to a Content Injection flaw. The root cause is insufficient validation of a URL parameter within the PDF viewer , which allows an attacker to load and display a document under the trust of the legitimate application domain. This vulnerability ...

CVE-2026-102093

Kiteworks Core versions prior to 9.5.0 are vulnerable to Improper Privilege Management due to a failure in enforcing restrictions on role assignment. This flaw allows an authenticated administrative user with limited, non-Sysadmin role-management permissions to bypass authorization limits and ele...

CVE-2026-102130

The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...

CVE-2026-102097

Kiteworks Email Protection Gateway versions before 9.5.0 is vulnerable to Remote Code Execution (RCE) . The flaw exists because the gateway fails to sufficiently validate the contents of configuration files imported by an authenticated administrator . An attacker with administrative privileges co...

CVE-2026-102136

In multi-node deployments , a vulnerability exists where an attacker with existing code execution on one appliance node can submit values through an internal cluster interface . Due to insufficient validation, these values are written into the monitoring configuration of another node, potentially...

CVE-2026-102114

A command injection vulnerability exists in Kiteworks that allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges. No specific r...

CVE-2026-102137

In Kiteworks Core , an authenticated administrator can bypass content validation during an administrative file upload. This allows for the storage of files containing dangerous content on the appliance. While this vulnerability enables the storage of malicious files, it does not directly result i...

CVE-2026-102094

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection . The vulnerability exists because the mail-processing pipeline fails to sufficiently restrict code loaded from an imported rule configuration . An authenticated administrator with mail-rule configurati...

CVE-2026-102101

Kiteworks Core versions before 9.5.0 are vulnerable to a deserialization of untrusted data weakness. This vulnerability allows an attacker to potentially achieve remote code execution on the appliance by providing crafted data that is deserialized unsafely. However, this issue is not exploitable ...

CVE-2026-102107

Kiteworks Core contains a business logic flaw within its file-request feature. This flaw allows an authenticated user to send requests that appear to originate from a different user because the server fails to verify if the requester is authorized to act as the specified account. An attacker coul...

CVE-2026-102129

A privilege escalation vulnerability exists in the user-provisioning interface of Kiteworks Core . The root cause is a failure to verify if the requesting administrator possesses the authorization required to grant specific roles. Consequently, an administrator with limited permissions for role c...

CVE-2026-102141

The Kiteworks Core software is vulnerable to privilege escalation because two cluster-management operations fail to validate supplied file paths. An attacker with root access on a single cluster node can write files as root onto another node, potentially leading to unauthorized execution of those...

CVE-2026-102092

Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-site Scripting (XSS) flaw. An authenticated attacker can store crafted content that executes arbitrary JavaScript in another user's authenticated session during the preview of shared content. This vulnerability could lead to ...

CVE-2026-102106

The Kiteworks Email Protection Gateway contains an improper authentication vulnerability within an administrative service. The root cause is that the service fails to consistently enforce administrator authentication, allowing a required password check to be bypassed. An attacker referencing a va...

CVE-2026-102146

The Kiteworks Email Protection Gateway is vulnerable to an Arbitrary File Write vulnerability caused by Server-Side Template Injection . An authenticated administrator with limited, delegated permissions can exploit this to write files with attacker-controlled content to arbitrary locations acces...

CVE-2026-102117

The Kiteworks Core platform is vulnerable to Remote Code Execution (RCE) when the remote-support capability is licensed and enabled. An authenticated System Administrator who possesses the key protecting the submitted data can redirect the system's outbound support connection to a destination of ...

CVE-2026-102140

In Kiteworks Core , an authenticated administrator can exploit a vulnerability where administrative imports only validate the file header instead of the entire file content. This insufficient verification of data authenticity allows for the acceptance and processing of unverified or forged conten...

CVE-2026-102100

Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This weakness allows an authenticated user to submit malicious content that executes arbitrary JavaScript when viewed by another user within their authenticated session. Such exploitation could enab...

CVE-2026-102110

A Kiteworks appliance is vulnerable to a missing authentication flaw in a setup function used during initial activation . An unauthenticated network attacker can repeatedly re-trigger the privileged activation process during this specific window because the endpoint fails to enforce intended stat...

CVE-2026-102119

A path traversal weakness exists in an optional, non-default administrative feature of the Kiteworks Email Protection Gateway . This flaw allows an authenticated administrator to move files to unintended locations outside the designated directory, which could potentially lead to arbitrary code ex...

CVE-2026-102122

The Kiteworks Core platform contains an incorrect authorization vulnerability where the system fails to properly restrict role assignments for shared folders. In a default configuration, an authenticated user with the Manager role can escalate their privileges by granting themselves or other fold...

CVE-2026-102145

An authenticated administrator can exploit a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Core caused by CRLF Injection . This flaw allows the server to issue requests to and interact with internal network services that are intended to be unreachable through the web interface. Wh...

CVE-2026-102111

The Kiteworks Core software contains a vulnerability where it fails to enforce the maximum permitted value for a configurable security-policy setting . An authenticated administrator can set this value outside its intended range, causing the associated security control to remain silently ineffect...

CVE-2026-102135

The Kiteworks Email Protection Gateway is vulnerable to code execution via deserialization of untrusted data on clusters with database replication enabled. A trusted party can submit a crafted serialized object that is processed without sufficient validation, potentially allowing execution as the...

CVE-2026-102144

The Kiteworks Email Protection Gateway is vulnerable to a resource exhaustion flaw. An unauthenticated remote attacker can repeatedly trigger a comparatively expensive server-side operation, resulting in a partial denial of service . No specific exploit information or remediation details are prov...

CVE-2026-102139

The Kiteworks Email Protection Gateway contains an incorrect authorization flaw within its optional large file exchange feature. The root cause is a failure to properly verify that a requesting user is a party to the package they are attempting to access. This allows an authenticated user to read...

CVE-2026-102138

The Kiteworks Core server is vulnerable to a Server-Side Request Forgery (SSRF) flaw. An authenticated administrator on a node with the optional, separately licensed gateway role enabled can provide a connector URL. Due to insufficient validation of the URL's scheme or destination, the server may...