CVE-2026-102140 is a vulnerability in Kiteworks Core where an authenticated administrator can import files without full verification of their contents. The import process only validates the file header, allowing unverified or forged content to be processed. This flaw affects data integrity but does not impact confidentiality or availability. The vulnerability affects Kiteworks Core versions prior to 9.5.1. The CVSS score is 4.9, indicating a medium severity level.
CVE-2026-102141 is a vulnerability in Kiteworks Core cluster-management operations where file paths supplied were not validated. This allows an attacker with root access on one cluster node to write files as root onto another node, potentially causing execution there. Exploitation requires high privileges (root) on a backend node and the presence of a pending software patch on the target node. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-102142 is a high-severity vulnerability in the Kiteworks Core appliance where a system notification template is processed by a template engine that evaluates expressions within the template body. An authenticated System Administrator can craft a malicious template that, when the notification is sent, executes operating system commands on the appliance. This vulnerability affects Kiteworks Core versions from initial up to but not including 9.5.1.
CVE-2026-102143 is a vulnerability in Kiteworks Email Protection Gateway where an unauthenticated attacker can write a file with attacker-controlled content to the appliance filesystem via an administrative upload handler lacking proper authentication. This flaw does not directly allow code execution, as that would require an additional vulnerability to place the file in an executable location. The issue affects versions prior to 9.5.1.
Kiteworks Core versions prior to 9.5.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to submit malicious content that executes arbitrary JavaScript in the context of another user's authenticated session when viewed. Such exploitation could enable actions on behalf of the victim, including potential account takeover of users with elevated privileges. Exploitation requires the victim to view the malicious content. The vulnerability has a high severity rating with a CVSS score of 8.7.
CVE-2026-102144 is a resource exhaustion vulnerability in Kiteworks Email Protection Gateway that allows an unauthenticated remote attacker to repeatedly trigger an expensive server-side operation, causing a partial denial of service. The vulnerability is due to missing authentication for a critical function. It affects versions from 0 up to but not including 9.5.1. The CVSS score is 5.3 (medium severity). No known exploits are reported in the wild and no patch information is provided.
CVE-2026-102150 is a vulnerability in Kiteworks Secure Data Forms where a critical function in the Advanced Forms component is accessible without authentication. This allows an unauthenticated attacker to perform a limited set of internal service operations on the platform. However, the vulnerability does not allow access to user accounts, stored files, or form submissions. The affected versions are from 9.3.0 up to but not including 9.5.1. The vulnerability has a CVSS score of 7.2, indicating high severity.
CVE-2026-102149 is a critical vulnerability in Kiteworks Email Protection Gateway where the system does not properly restrict certificate assignment to user accounts. This flaw allows an attacker to associate a certificate with another user's account, potentially compromising the confidentiality and integrity of encrypted emails. If certificate-based login is enabled, unauthorized access to the affected account may also be possible.
CVE-2026-102147 is a critical stored cross-site scripting (XSS) vulnerability in Kiteworks Core. An unauthenticated attacker can inject malicious content that executes arbitrary JavaScript in the session of an administrator viewing the affected page. This can lead to full administrative control, including creating new admin accounts. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. No patch information is provided in the available data.
CVE-2026-102146 is a vulnerability in Kiteworks Email Protection Gateway where an authenticated administrator with limited delegated permissions can write files with attacker-controlled content to arbitrary locations accessible by the service account. This privilege escalation can lead to modification of application files or configurations and potentially disrupt service availability. The vulnerability affects versions prior to 9.5.1. The CVSS score is 6.5, indicating a medium severity impact.
CVE-2026-102145 is a vulnerability in Kiteworks Core where an authenticated administrator can exploit improper neutralization of CRLF sequences (CRLF Injection). This flaw allows the server to issue requests to internal network services that should not be accessible through the interface. The vulnerability does not lead to code execution by itself.
Kiteworks Email Protection Gateway versions before 9.5.0 contain a vulnerability that allows an authenticated administrator to import configuration files without sufficient validation. This flaw can lead to remote code execution on the affected gateway by processing crafted submissions. The vulnerability is identified as CWE-22 (Path Traversal) and CWE-94 (Improper Control of Generation of Code).
Kiteworks Core versions prior to 9.5.0 contain an OS Command Injection vulnerability. This flaw allows an authenticated administrator to upload a specially crafted configuration package that is not properly validated. Exploiting this vulnerability could lead to arbitrary command execution on the underlying system with potentially elevated privileges.
Kiteworks Core versions prior to 9.5.0 contain a path traversal vulnerability (CWE-22) in an administrative export feature. This flaw allows an authenticated administrator to write files to arbitrary locations on the host system, which could lead to command execution on the appliance. Exploitation requires valid administrative credentials and access to the vulnerable export function.
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.