CVE-2026-102117

HighCVSS 7.2/10Last modified Oct 13, 2026

Description

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-807 CWE-940

Affected software

Vendor	Product	Versions
Kiteworks	Core	< 9.5.1

References

Timeline

Published: Sep 30, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021187.8A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service CVE-2026-1021197.2A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten CVE-2026-102126.3A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_a CVE-2026-1021208.8A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl CVE-2026-1021218.6A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to a CVE-2026-1021224.3Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authentica CVE-2026-1021237.4A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthentica CVE-2026-1021246.5A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthentica CVE-2026-1021258.8The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already execut CVE-2026-1021268.1A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated CVE-2026-1021277.0An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message CVE-2026-1021287.5An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a