Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg
CVE-2026-102150Kiteworks Secure Data Forms Missing Authentication for Critical Function
High 7.2
In plain English
A high-severity missing authentication in Secure Data Forms from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.2%top 83.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kiteworks | Secure Data Forms | 9.3.0 – before 9.5.1 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N