CVE-2026-24751 is a reflected cross-site scripting (CWE-79) vulnerability in Kiteworks Secure Data Forms before version 9.3.0. An attacker can exploit this by injecting malicious JavaScript code that is reflected back to the user, potentially leading to unauthorized script execution in the user's browser. The vulnerability affects versions earlier than 9.3.0 and is mitigated by upgrading to version 9.3.0 or later. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the affected user's browser session, potentially compromising confidentiality of sensitive information accessible to the user. The integrity impact is low and availability is not affected. This can facilitate attacks such as session hijacking or unauthorized actions performed on behalf of the user.

Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that addresses this reflected XSS vulnerability. No other mitigation details are provided. Patch status is confirmed by the vendor advisory indicating the fix is included starting with version 9.3.0.