Accellion Kiteworks
83 CVEs affecting Accellion Kiteworks. Latest disclosed: 2026-09-30. Critical: 9, High: 41.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102115 | Critical | 9.8 | 2026-09-30 | Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a use… |
CVE-2026-102149 | Critical | 9.4 | 2026-09-30 | Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a… |
CVE-2026-102147 | Critical | 9.3 | 2026-09-30 | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary J… |
CVE-2026-102106 | Critical | 9.1 | 2026-09-30 | Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not… |
CVE-2026-102105 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102104 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102103 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102102 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102095 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side… |
CVE-2026-102125 | High | 8.8 | 2026-09-30 | The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that san… |
CVE-2026-102120 | High | 8.8 | 2026-09-30 | A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks d… |
CVE-2026-23514 | High | 8.8 | 2026-03-25 | Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to a… |
CVE-2021-31586 | High | 8.8 | 2021-06-23 | Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. |
CVE-2026-102100 | High | 8.7 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an… |
CVE-2026-102092 | High | 8.7 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that exe… |
CVE-2026-102121 | High | 8.6 | 2026-09-30 | A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors… |
CVE-2026-24752 | High | 8.2 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacke… |
CVE-2026-24751 | High | 8.2 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacke… |
CVE-2026-102126 | High | 8.1 | 2026-09-30 | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to stor… |
CVE-2026-102101 | High | 8.1 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain condi… |