by Kastro
Paper/Archive/CVE-2026-102115

CVE-2026-102115

Kiteworks Core — Kiteworks Core Authentication Bypass in the Password Reset Workflow

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.5.635 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

Affected

ProductAffectedFixed inSource
Core< 9.5.09.5.0CNA

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639writeupraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json