Kiteworks Core: Deserialization of untrusted data allows code execution
Summary
Kiteworks Core before version 9.5.0 deserializes untrusted data without sufficiently ensuring that the result is valid. According to the description, an attacker could execute code on the appliance. Exploitation first requires that the attacker can influence the affected data, so the flaw is not exploitable on its own. The CVSS vector lists a local attack vector, which conflicts with the description; the vendor has not clarified this.
Affected
- Kiteworks Core versions before 9.5.0
Fixed in
- Kiteworks Core 9.5.0 or later (per vendor advisory GHSA-x5hx-fgrp-prvf)
Workaround
Unknown. No vendor workaround is documented in the sources; upgrading is the only remedy listed.
Exploitation
- No confirmed exploitation in the wild.
- CISA SSVC assessment: Exploitation none, Automatable no.
- One aggregator lists a proof-of-concept count of 1; this is unverified.
Our recommendation
- Upgrade self-managed Kiteworks Core instances to 9.5.0 or later and treat this as a patch-priority item.
- Confirm the exact installed version with the vendor.
- Check whether any Kiteworks Core instance is reachable from the internet and restrict access.
- Monitor for unusual activity on the appliance until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-x5hx-fgrp-prvf (Kiteworks) github.com
- OpenCVE record for CVE-2026-102101 app.opencve.io
- Strix CVE record for CVE-2026-102101 www.strix.ai
- ThreatInt CVE record for CVE-2026-102101 cve.threatint.com
- TechCrunch: Kiteworks urges customers to shut down servers techcrunch.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:06.
Original description (NVD)
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.