CVE-2026-102101

Received Received - Intake

Deserialization Flaw in Kiteworks Core Allows RCE

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102101

EUVD

EUVD-2026-90276

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	core	to 9.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

Kiteworks Core before version 9.5.0 has a vulnerability where untrusted data can be deserialized unsafely. This could allow crafted data to execute remote code on the appliance under certain conditions. Exploitation requires an attacker to influence the affected data first, so it is not exploitable alone.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute remote code on the Kiteworks appliance. This may lead to unauthorized access, data breaches, or system compromise, depending on the appliance's configuration and network exposure.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address this to maintain data protection and regulatory adherence.

Mitigation Strategies

Update Kiteworks Core to version 9.5.0 or later to address the deserialization vulnerability. Ensure all systems are patched promptly to prevent potential remote code execution.

Hi! I’m here to help you understand CVE-2026-102101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70