CVE-2026-102112

HighCVSS 7.8/10Last modified Oct 7, 2026

Description

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021137.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021147.2A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-syst CVE-2026-1021159.8Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the ema CVE-2026-1021167.2-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended locati CVE-2026-1021177.2On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key CVE-2026-1021187.8A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service CVE-2026-1021197.2A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten CVE-2026-102126.3A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_a CVE-2026-1021208.8A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl CVE-2026-1021218.6A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to a CVE-2026-1021224.3Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authentica CVE-2026-1021237.4A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthentica