Kiteworks Core before version 9.5.0 is affected by a deserialization of untrusted data vulnerability (CWE-502). This flaw could allow an attacker who can control the deserialized input to execute arbitrary code remotely on the appliance. The vulnerability requires local access or the ability to influence the data being deserialized, limiting direct exploitation. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, but with attack vector limited to local or adjacent network (AV:L) and high attack complexity (AC:H).

Successful exploitation could lead to remote code execution on the Kiteworks Core appliance, compromising confidentiality, integrity, and availability of the system. However, exploitation depends on the attacker first being able to influence the deserialized data, so it is not exploitable without this prerequisite.

Upgrade Kiteworks Core to version 9.5.0 or later where this vulnerability is fixed. Since this is not a cloud service, the vendor does not manage patching automatically. No known exploits are reported in the wild. Until patched, restrict access to interfaces that could allow injection of crafted serialized data.