CriticalCritical vulnerability

CVE-2026-102147 (CVSS 9.3)

NVD · officialPublished Sep 30, 2026Risk 50/100

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

Technical details

CVSS

9.3

AV:NetworkAC:LowPR:NoneUI:RequiredC:HighI:HighA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source