CVE-2026-102100

Received Received - Intake

Stored XSS in Kiteworks Core

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102100

EUVD

EUVD-2026-90269

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	core	to 9.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Kiteworks Core before version 9.5.0 has a stored cross-site scripting (XSS) vulnerability. An authenticated user can submit malicious content that, when viewed by another user, executes arbitrary JavaScript in their authenticated session. This could allow attackers to perform actions on behalf of victims or take over accounts, including those with higher privileges.

Detection Guidance

Detection of this stored XSS vulnerability requires manual inspection of user-generated content and application logs. Check for suspicious JavaScript code in stored messages, comments, or file names. Review server logs for unusual input patterns or requests containing script tags. No automated commands are provided as detection depends on application-specific data handling.

Impact Analysis

If you use Kiteworks Core before version 9.5.0, an attacker with access could inject malicious scripts into content you view. This could lead to unauthorized actions performed in your session, such as changing settings or accessing sensitive data. Account takeover, including for privileged users, is possible if the attacker targets you.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Kiteworks Core to version 9.5.0 or later immediately. Implement input validation and output encoding for all user-supplied content. Restrict user permissions to minimize potential impact. Monitor for unusual activity in authenticated sessions.

Hi! I’m here to help you understand CVE-2026-102100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70