CVE-2026-24752 is a reflected XSS vulnerability (CWE-79) in kiteworks Secure Data Forms versions before 9.3.0. An attacker can craft a malicious link or input that causes a victim's browser to execute arbitrary JavaScript code when interacting with the vulnerable web form. This vulnerability arises from improper neutralization of input during web page generation. The vendor has released version 9.3.0 to address this issue.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser session, potentially resulting in session hijacking, information disclosure, or other client-side impacts. The CVSS v3.1 base score is 8.2 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Upgrade kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that resolves this vulnerability. No other vendor advisories or temporary mitigations are provided. Patch status is not explicitly confirmed beyond the upgrade recommendation; verify with the vendor advisory for current remediation guidance.