Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg

CVE-2026-102147Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

Critical 9.3

In plain English

A critical-severity cross-site scripting in Core from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.5%top 59.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

Affected products (as reported)

Vendor	Product	Versions
Kiteworks	Core	0 – before 9.5.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

url
url third-party-advisory