by Kastro
Paper/Archive/CVE-2026-102147

CVE-2026-102147

Kiteworks Core — Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 40.0.400 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

Affected

ProductAffectedFixed inSource
Core< 9.5.19.5.1CNA

Scores by source

cisa-cg (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93rwriteupraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json