CVE-2026-102147
Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 30, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 28, 2026
Description
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.3 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | cisa-cg |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
CoreKiteworks |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.