CVE-2026-102124

Received Received - Intake

Kiteworks Appliance Unauthenticated Configuration Access

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102124

EUVD

EUVD-2026-90293

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	appliance	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves a Kiteworks appliance setup interface that fails to enforce authentication after initial configuration. An attacker with network access could read and modify limited setup records, such as a contact name and email address, without authentication.

Detection Guidance

Check if the Kiteworks appliance setup interface is accessible without authentication. Use network scanning tools like nmap to identify open ports and services on the appliance. Verify if the interface allows unauthenticated access to setup records by attempting to access it via a web browser or curl commands.

Impact Analysis

An attacker could access and alter sensitive setup information, potentially leading to unauthorized changes in system configuration or exposing contact details. This may disrupt appliance functionality or enable further attacks.

Compliance Impact

This vulnerability could impact compliance by exposing personal data (e.g., contact details) without authorization, potentially violating GDPR or HIPAA requirements for data protection and access controls.

Mitigation Strategies

Apply the latest security patches or updates from Kiteworks to enforce authentication on the setup interface. Restrict network access to the appliance by configuring firewalls to allow only trusted IP addresses. Review and update appliance configuration to ensure authentication is enforced for all interfaces.

Hi! I’m here to help you understand CVE-2026-102124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70