CVE-2026-102115 – Kiteworks Core
“When an outsider can reset an admin's password without ever seeing the reset email, the front door to your file-sharing platform is already open.”
This Kiteworks Core update fixes 15 vulnerabilities. Versions before 9.5.0 are affected. Two flaws are Critical. CVE-2026-102115 has a CVSS score of 9.8, Critical severity: a password reset flaw lets an unauthenticated attacker take over any account with a locally stored password, including administrator accounts. CVE-2026-102147 has a CVSS score of 9.3, Critical severity: a stored cross-site scripting flaw lets an unauthenticated attacker run script in an administrator's session and seize full administrative control.
The other 13 flaws are rated High. They allow command injection, unsafe deserialization, arbitrary file writes, and privilege escalation to root or full system administrator. CVE-2026-102120 has a CVSS score of 8.8, High severity. CVE-2026-102101 has a CVSS score of 8.1, High severity. CVE-2026-102112, CVE-2026-102113, and CVE-2026-102118 each have a CVSS score of 7.8, High severity. CVE-2026-102123 has a CVSS score of 7.4, High severity. CVE-2026-102093, CVE-2026-102096, CVE-2026-102099, CVE-2026-102114, CVE-2026-102129, CVE-2026-102132, and CVE-2026-102142 each have a CVSS score of 7.2, High severity. Taken together, these flaws let an attacker move from an outside foothold to root control of the appliance.
Key Details
- Affected Product
- Accellion Kiteworks
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-640