CVE-2026-28269
Received Received - Intake
Command Injection in Kiteworks Allows Critical File Overwrite

Publication date: 2026-02-26

Last updated on: 2026-03-03

Assigner: GitHub, Inc.

Description
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-26
Last Modified
2026-03-03
Generated
2026-06-16
AI Q&A
2026-02-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28269
EUVD
EUVD-2026-8918
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
accellion kiteworks to 9.2.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Kiteworks, a private data network, in versions prior to 9.2.0. It involves the command execution functionality where authenticated users can redirect the output of commands to arbitrary file locations. This flaw allows attackers to overwrite critical system files, potentially leading to elevated access privileges.

Impact Analysis

Exploitation of this vulnerability can allow an authenticated user to overwrite important system files, which may result in gaining elevated access rights. This could compromise the integrity and security of the affected system, potentially allowing unauthorized actions or control.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Kiteworks to version 9.2.0 or later, as this version contains the patch that fixes the command execution issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart