CVE-2026-102147

Received Received - Intake

Stored XSS in Kiteworks Core

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102147

EUVD

EUVD-2026-90383

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	core	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Kiteworks Core. An unauthenticated attacker can store malicious content that executes arbitrary JavaScript when an administrator views the affected page. This could allow the attacker to gain full administrative control, including creating new admin accounts.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take over your Kiteworks Core instance as an administrator. They could create new admin accounts, access sensitive data, or perform unauthorized actions in your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. A successful exploit could result in data breaches, unauthorized modifications, or loss of audit trails.

Mitigation Strategies

Apply the latest security patches or updates provided by Kiteworks to address the stored XSS vulnerability. Review and sanitize all user-generated content before rendering it in administrator views to prevent script execution. Monitor administrator sessions for unusual activity or unauthorized account creation.

Hi! I’m here to help you understand CVE-2026-102147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70