Is CVE-2026-102126 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102126 being exploited in the wild.

How severe is CVE-2026-102126?

High severity, with a CVSS score of 8.1, published 30 September 2026.

Is there a fix for CVE-2026-102126?

A patch was published on 2026-09-30: version 9.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102126 attacked?

It is attacked over the network.

Am I affected by CVE-2026-102126?

Check whether you run Kiteworks Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102126: Kiteworks Core stored XSS privilege escalation

CVE-2026-102126 · Severity: high · CVSS 8.1 · Published 2026-09-30

Kiteworks Core, a secure file transfer and collaboration platform, contains a stored cross-site scripting vulnerability that allows a delegated administrator with limited permissions to inject malicious code that executes in the browser of a System Administrator. An attacker exploiting this could hijack the System Administrator's session and create new admin accounts, gaining full control of the tenant.

Technologies: Kiteworks Core. Vendors: Kiteworks.

Quick answers

Is CVE-2026-102126 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102126 being exploited in the wild.
How severe is CVE-2026-102126?: High severity, with a CVSS score of 8.1, published 30 September 2026.
Which products and versions are affected?: Kiteworks Core before 9.5.1.
Is there a fix for CVE-2026-102126?: A patch was published on 2026-09-30: version 9.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102126 attacked?: It is attacked over the network.
Am I affected by CVE-2026-102126?: Check whether you run Kiteworks Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS flaw in Kiteworks Core allows a low-privileged delegated administrator to craft and store JavaScript payloads that execute in the authenticated session of a System Administrator viewing the affected page. The vulnerability requires the attacker to already have delegated admin access and the victim to view the malicious content, but leads to full privilege escalation through session hijacking and account creation. The fix is available in version 9.5.1 and later.

Affected products

Kiteworks Core before 9.5.1

Timeline

2026-09-30: disclosed
2026-09-30: patched: version 9.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.