Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg
CVE-2026-102125Kiteworks Core Sandbox Escape
High 8.8
In plain English
A high-severity security flaw in Core from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
Affected products (as reported)
Weakness: CWE-653, CWE-668 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H