CVE-2026-102116

HighCVSS 7.2/10Last modified Oct 8, 2026

Description

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-91

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021177.2On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key CVE-2026-1021187.8A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service CVE-2026-1021197.2A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten CVE-2026-102126.3A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_a CVE-2026-1021208.8A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl CVE-2026-1021218.6A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to a CVE-2026-1021224.3Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authentica CVE-2026-1021237.4A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthentica CVE-2026-1021246.5A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthentica CVE-2026-1021258.8The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already execut CVE-2026-1021268.1A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated CVE-2026-1021277.0An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message