Vulnerability · Published Jun 1, 2026 · Assigned by GitHub_M

CVE-2026-24782Kiteworks Secure Data Forms has a SQL Injection vulnerability

High 7.6

In plain English

A high-severity SQL injection in Secure Data Forms from kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Affected products (as reported)

Vendor	Product	Versions
kiteworks	Secure Data Forms	< 9.3.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c x_refsource_CONFIRM