CVE-2026-102125: CWE-653 Improper Isolation or Compartmentalization in Kiteworks Core
CVE-2026-102125 is a high-severity vulnerability in Kiteworks Core where the sandbox isolating document conversion does not fully confine code execution. This allows code running inside the sandbox to escape confinement and operate with the privileges of the service account running the application. Exploitation could enable an attacker to read or modify application data and configuration or disrupt the service on the affected appliance.
AI Analysis
Technical Summary
The vulnerability involves improper isolation or compartmentalization (CWE-653) in the sandbox environment of the Kiteworks Core appliance. The sandbox intended to isolate document conversion processes fails to fully contain code execution, allowing code within the sandbox to escape and act with the privileges of the service account running the application. This could lead to unauthorized access to application data, configuration changes, or service disruption. The CVSS 3.1 score is 8.8 (high), with attack vector local, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The affected versions are all Kiteworks Core versions from 0 up to but not including 9.5.0.
Potential Impact
An attacker who can execute code within the sandbox could escape its confinement and gain the privileges of the service account running the Kiteworks Core application. This could allow unauthorized reading or modification of application data and configuration, or disruption of the service on the affected appliance. The vulnerability has a high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor updates or configuration changes. Until a fix is available, limit local access to trusted users to reduce risk.
CVE-2026-102125: CWE-653 Improper Isolation or Compartmentalization in Kiteworks Core
Description
CVE-2026-102125 is a high-severity vulnerability in Kiteworks Core where the sandbox isolating document conversion does not fully confine code execution. This allows code running inside the sandbox to escape confinement and operate with the privileges of the service account running the application. Exploitation could enable an attacker to read or modify application data and configuration or disrupt the service on the affected appliance.
CVSS v3.1
Score 8.8high
Affected software
Kiteworks
Core
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves improper isolation or compartmentalization (CWE-653) in the sandbox environment of the Kiteworks Core appliance. The sandbox intended to isolate document conversion processes fails to fully contain code execution, allowing code within the sandbox to escape and act with the privileges of the service account running the application. This could lead to unauthorized access to application data, configuration changes, or service disruption. The CVSS 3.1 score is 8.8 (high), with attack vector local, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The affected versions are all Kiteworks Core versions from 0 up to but not including 9.5.0.
Potential Impact
An attacker who can execute code within the sandbox could escape its confinement and gain the privileges of the service account running the Kiteworks Core application. This could allow unauthorized reading or modification of application data and configuration, or disruption of the service on the affected appliance. The vulnerability has a high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor updates or configuration changes. Until a fix is available, limit local access to trusted users to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisa-cg
- Date Reserved
- 2026-09-28T17:39:13.563Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abd724f2a4e24523d8ebe14
Added to database: 09/30/2026, 20:34:23 UTC
Last enriched: 09/30/2026, 21:04:04 UTC
Last updated: 10/01/2026, 04:46:47 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.