CVE-2026-24751 is a reflected cross-site scripting (XSS) vulnerability in Kiteworks Secure Data Forms before version 9.3.0. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), enabling an attacker to inject and execute arbitrary JavaScript code in the context of a victim's browser. This can lead to partial confidentiality impact and integrity loss but does not affect availability. The CVSS 3.1 vector indicates the attack requires no privileges, has low attack complexity, user interaction is required, and the scope is changed.

Successful exploitation can result in the execution of arbitrary JavaScript code in the context of the victim user, potentially leading to information disclosure (high confidentiality impact) and limited integrity impact. There is no impact on availability. This can facilitate attacks such as session hijacking or unauthorized actions performed by the victim user.

Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later, where this vulnerability has been patched. No other mitigation details are provided. Patch status is not explicitly confirmed in the vendor advisory, but the description clearly states upgrading to 9.3.0 or later addresses the issue.