CVE-2026-102150

Received Received - Intake

Unauthenticated Access in Kiteworks Advanced Forms

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102150

EUVD

EUVD-2026-90386

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	advanced_forms	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Kiteworks Advanced Forms component. A function within it could be accessed without authentication, allowing an attacker to perform limited internal service operations on the Kiteworks platform. It did not provide access to user accounts, stored files, or form submissions.

Detection Guidance

This vulnerability involves an unauthenticated function in Kiteworks Advanced Forms. To detect it, check for unauthorized access to internal service operations. Monitor network traffic for unusual requests to the affected component. Verify authentication requirements for all exposed endpoints in the Advanced Forms module.

Impact Analysis

An unauthenticated attacker could exploit this to perform restricted internal actions on the Kiteworks platform. While sensitive data like user accounts or files remains protected, operational integrity may be compromised.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized actions on the platform, potentially violating integrity requirements in GDPR or HIPAA. However, since no data access is involved, the impact may be limited to operational controls.

Mitigation Strategies

Apply the latest security patches or updates from Kiteworks for the Advanced Forms component to address the unauthenticated function access. Ensure network segmentation to limit exposure of internal services. Monitor logs for unusual activity targeting the affected function.

Hi! I’m here to help you understand CVE-2026-102150. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70