Kiteworks Core: Stored cross-site scripting enabling administrator privilege escalation
Summary
Kiteworks Core contains a stored cross-site scripting (XSS) flaw (CWE-79). An administrator who holds only a single, narrowly scoped delegated permission can store crafted content that runs JavaScript in the session of a System Administrator who views the affected page. This could allow the attacker to take full administrative control of the tenant, including creating a new administrative account. Exploitation requires an authenticated admin account with that permission and user interaction by a System Administrator.
Affected
- Kiteworks Core before version 9.5.1
Fixed in
- Kiteworks Core 9.5.1 or later
Workaround
- No vendor workaround known. Upgrading to 9.5.1 is the documented remedy.
- Interim measures (not vendor guidance): limit delegated admin permissions to the minimum, review recently created or changed administrative accounts, and restrict access to the admin interface until the upgrade is complete.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV according to a third-party source.
- No public proof of concept found at time of writing. Unknown whether exploitation occurs in the wild.
Our recommendation
- Confirm the installed Kiteworks Core version and upgrade to 9.5.1 or later.
- Review administrative accounts and delegated permissions, and look for unexpected new administrative accounts.
- Check whether the admin interface is reachable from the internet and restrict access if it is.
- Monitor for unexpected changes in administrative accounts until patching is verified.
- Recheck the vendor advisory and exploitation status before final reporting.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ccfx-6hq4-fx4g github.com
- CISA CSAF advisory VA-26-274-01 raw.githubusercontent.com
- OpenCVE CVE-2026-102126 app.opencve.io
- Strix.ai CVE-2026-102126 www.strix.ai
- VulDB CVE-2026-102126 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:06.
Original description (NVD)
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.