CVE-2026-102125
Kiteworks Core Sandbox Escape
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 30, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 28, 2026
Description
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | cisa-cg |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CoreKiteworks |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.