CVE-2026-28269

Received Received - Intake

Command Injection in Kiteworks Allows Critical File Overwrite

Publication date: 2026-02-26

Last updated on: 2026-03-03

Assigner: GitHub, Inc.

Description

Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-26

Last Modified

2026-03-03

Generated

2026-07-06

AI Q&A

2026-02-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-28269

EUVD

EUVD-2026-8918

Affected Vendors & Products

Vendor	Product	Version / Range
accellion	kiteworks	to 9.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Kiteworks, a private data network, in versions prior to 9.2.0. It involves the command execution functionality where authenticated users can redirect the output of commands to arbitrary file locations. This flaw allows attackers to overwrite critical system files, potentially leading to elevated access privileges.

Impact Analysis

Exploitation of this vulnerability can allow an authenticated user to overwrite important system files, which may result in gaining elevated access rights. This could compromise the integrity and security of the affected system, potentially allowing unauthorized actions or control.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Kiteworks to version 9.2.0 or later, as this version contains the patch that fixes the command execution issue.

Hi! I’m here to help you understand CVE-2026-28269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70