# CVE-2026-102140: Kiteworks Core insufficient verification of data authenticity in import

Source: https://junglewise.ai/threats/cve-2026-102140-an-authenticated-administrator-could-initiate-an-administrative  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102140 · Severity: medium · CVSS 4.9 · Published 2026-09-30

Kiteworks Core, a secure file transfer and management platform, allows authenticated administrators to import configuration or data files. An attacker with admin credentials could upload a malicious or forged file that passes only a header validation check, bypassing full content verification and compromising the integrity of the system's imported data.

Technologies: [Kiteworks Core](https://junglewise.ai/threats/technologies/kiteworks-core). Vendors: [Kiteworks](https://junglewise.ai/threats/vendors/kiteworks).

## Quick answers

**Is CVE-2026-102140 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102140 being exploited in the wild.

**How severe is CVE-2026-102140?** Medium severity, with a CVSS score of 4.9, published 30 September 2026.

**Which products and versions are affected?** Kiteworks Core before 9.5.1.

**Is there a fix for CVE-2026-102140?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102140 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102140?** Check whether you run Kiteworks Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the administrative import function, which validates only the file header rather than the complete file contents, allowing unverified or forged data to be accepted and processed. The flaw requires the attacker to have authenticated administrator privileges and network access to the import endpoint (CVSS vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N). Kiteworks Core versions prior to 9.5.1 are affected; upgrading to 9.5.1 or later addresses the issue.

## Affected products

- Kiteworks Core before 9.5.1

## Timeline

- 2026-09-30: disclosed

## References

- [https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw](https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json)

## Related threats

- [Kiteworks Core stored cross-site scripting in administrative interface](https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core)
- [Kiteworks Core SSRF via CRLF injection](https://junglewise.ai/threats/cve-2026-102145-an-authenticated-administrator-could-cause-the-server-to-issue)
- [Kiteworks Core remote code execution in notification template](https://junglewise.ai/threats/cve-2026-102142-a-system-notification-template-on-the-kiteworks-appliance-was)
- [Kiteworks Core privilege escalation in cluster-management operations](https://junglewise.ai/threats/cve-2026-102141-two-kiteworks-core-cluster-management-operations-did-not)
- [Kiteworks Core unrestricted upload of dangerous file type](https://junglewise.ai/threats/cve-2026-102137-an-authenticated-administrator-could-bypass-the-content)