CVE-2026-102125

Received Received - Intake

Kiteworks Sandbox Escape Vulnerability

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102125

EUVD

EUVD-2026-90292

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-653	The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Attack-Flow Graph

Executive Summary

This vulnerability involves a sandbox escape in a Kiteworks appliance. The sandbox meant to isolate document conversion did not fully restrict code execution, allowing code within it to break out and gain the privileges of the application's service account. This could let an attacker read or modify data and settings or disrupt the service.

Impact Analysis

If exploited, this flaw could allow an attacker with access to the sandbox to gain elevated privileges. This might lead to unauthorized access to sensitive data, modification of system configurations, or causing service disruptions on the affected appliance.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized data exposure or alteration could result in legal penalties or loss of certification.

Mitigation Strategies

Apply the latest security patches or updates provided by Kiteworks to fix the sandbox confinement issue. Ensure the service account running the application has minimal privileges. Monitor the appliance for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-102125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70