Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg
CVE-2026-102117Kiteworks Core Remote Code Execution
High 7.2
In plain English
A high-severity security flaw in Core from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Official description
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account.
Affected products (as reported)
Weakness: CWE-807, CWE-940 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H