CVE-2026-102126

HighCVSS 8.1/10Last modified Oct 7, 2026

Description

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Kiteworks	Core	< 9.5.1

References

Timeline

Published: Sep 30, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021277.0An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message CVE-2026-1021287.5An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a CVE-2026-1021297.2A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assign CVE-2026-102135.4A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of CVE-2026-1021307.2Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influenc CVE-2026-1021317.2Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they co CVE-2026-1021327.2An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged i CVE-2026-1021336.6An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied pat CVE-2026-1021345.4Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentic CVE-2026-1021356.6On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted ser CVE-2026-1021366.3In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an interna CVE-2026-1021374.1An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dang