CVE-2026-102096

Received Received - Intake

OS Command Injection in Kiteworks Core

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102096

EUVD

EUVD-2026-90379

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	core	to 9.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Kiteworks Core before version 9.5.0 has an OS Command Injection vulnerability. An authenticated administrator can upload a configuration package with insufficiently validated contents. This allows a crafted package to execute arbitrary operating-system commands on the appliance, potentially with elevated privileges.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary commands on the affected system with elevated privileges. This may lead to unauthorized access, data breaches, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Organizations could face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Upgrade Kiteworks Core to version 9.5.0 or later to address the OS Command Injection vulnerability. Ensure configuration packages are properly validated before processing to prevent arbitrary command execution.

Hi! I’m here to help you understand CVE-2026-102096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70