VDB
CVE-2026-102147
CVE-2026-102147
PUBLISHED
CVSS 9.3 CRITICAL
Reported by cisa-cg · Published September 30, 2026
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.
Risk Scores
CVSS 3.1
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kiteworks | Core | 0, 9.5.1 |
| Kiteworks | Core | 0, 9.5.1, 0 |
Timeline
- Sep 30, 2026 CVE Published
- Oct 1, 2026 EPSS Score
- Oct 1, 2026 CVE Updated
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score