{"schema_version":1,"title":"Kiteworks Core vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 33 vulnerabilities in Kiteworks Core: 0 in the last 7 days and 33 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102147, was published on 30 September 2026. Nothing in the last four weeks, down from 33 vulnerabilities in the four before. 0 critical against 2.","url":"https://junglewise.ai/threats/technologies/kiteworks-core","json_url":"https://junglewise.ai/threats/technologies/kiteworks-core.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/kiteworks-core","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":18,"all_time":33,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":33,"last_365_days":33},"latest":[{"cve":"CVE-2026-102147","cvss":9.3,"slug":"cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core","title":"Kiteworks Core stored cross-site scripting in administrative interface","severity":"critical","exploited":false,"published_at":"2026-09-30T21:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core"},{"cve":"CVE-2026-102145","cvss":6.6,"slug":"cve-2026-102145-an-authenticated-administrator-could-cause-the-server-to-issue","title":"Kiteworks Core SSRF via CRLF injection","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:03.39+00:00","url":"https://junglewise.ai/threats/cve-2026-102145-an-authenticated-administrator-could-cause-the-server-to-issue"},{"cve":"CVE-2026-102142","cvss":7.2,"slug":"cve-2026-102142-a-system-notification-template-on-the-kiteworks-appliance-was","title":"Kiteworks Core remote code execution in notification template","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:03.027+00:00","url":"https://junglewise.ai/threats/cve-2026-102142-a-system-notification-template-on-the-kiteworks-appliance-was"},{"cve":"CVE-2026-102141","cvss":6.7,"slug":"cve-2026-102141-two-kiteworks-core-cluster-management-operations-did-not","title":"Kiteworks Core privilege escalation in cluster-management operations","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.903+00:00","url":"https://junglewise.ai/threats/cve-2026-102141-two-kiteworks-core-cluster-management-operations-did-not"},{"cve":"CVE-2026-102140","cvss":4.9,"slug":"cve-2026-102140-an-authenticated-administrator-could-initiate-an-administrative","title":"Kiteworks Core insufficient verification of data authenticity in import","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.783+00:00","url":"https://junglewise.ai/threats/cve-2026-102140-an-authenticated-administrator-could-initiate-an-administrative"},{"cve":"CVE-2026-102137","cvss":4.1,"slug":"cve-2026-102137-an-authenticated-administrator-could-bypass-the-content","title":"Kiteworks Core unrestricted upload of dangerous file type","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.423+00:00","url":"https://junglewise.ai/threats/cve-2026-102137-an-authenticated-administrator-could-bypass-the-content"},{"cve":"CVE-2026-102136","cvss":6.3,"slug":"cve-2026-102136-in-multi-node-deployments-an-attacker-who-had-already-obtained","title":"Kiteworks Core command execution through configuration injection","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.277+00:00","url":"https://junglewise.ai/threats/cve-2026-102136-in-multi-node-deployments-an-attacker-who-had-already-obtained"},{"cve":"CVE-2026-102134","cvss":5.4,"slug":"cve-2026-102134-kiteworks-core-did-not-apply-its-gateway-level-api-security","title":"Kiteworks Core gateway-level API security controls bypass","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.03+00:00","url":"https://junglewise.ai/threats/cve-2026-102134-kiteworks-core-did-not-apply-its-gateway-level-api-security"},{"cve":"CVE-2026-102133","cvss":6.6,"slug":"cve-2026-102133-an-optional-separately-licensed-repository-connector-feature-in","title":"Kiteworks Core command injection in repository connector","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:01.91+00:00","url":"https://junglewise.ai/threats/cve-2026-102133-an-optional-separately-licensed-repository-connector-feature-in"},{"cve":"CVE-2026-102132","cvss":7.2,"slug":"cve-2026-102132-an-administrative-import-function-in-kiteworks-core-did-not","title":"Kiteworks Core privilege escalation in administrative import","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.787+00:00","url":"https://junglewise.ai/threats/cve-2026-102132-an-administrative-import-function-in-kiteworks-core-did-not"},{"cve":"CVE-2026-102129","cvss":7.2,"slug":"cve-2026-102129-a-user-provisioning-interface-in-kiteworks-core-did-not-verify","title":"Kiteworks Core privilege escalation in user-provisioning interface","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.407+00:00","url":"https://junglewise.ai/threats/cve-2026-102129-a-user-provisioning-interface-in-kiteworks-core-did-not-verify"},{"cve":"CVE-2026-102126","cvss":8.1,"slug":"cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core","title":"Kiteworks Core stored XSS privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:00.963+00:00","url":"https://junglewise.ai/threats/cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core"},{"cve":"CVE-2026-102124","cvss":6.5,"slug":"cve-2026-102124-a-kiteworks-appliance-setup-interface-did-not-enforce","title":"Kiteworks Core authentication bypass in setup interface","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:00.677+00:00","url":"https://junglewise.ai/threats/cve-2026-102124-a-kiteworks-appliance-setup-interface-did-not-enforce"},{"cve":"CVE-2026-102123","cvss":7.4,"slug":"cve-2026-102123-a-kiteworks-appliance-setup-interface-did-not-confine-a-user","title":"Kiteworks Core path traversal in setup interface","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:00.517+00:00","url":"https://junglewise.ai/threats/cve-2026-102123-a-kiteworks-appliance-setup-interface-did-not-confine-a-user"},{"cve":"CVE-2026-102122","cvss":4.3,"slug":"cve-2026-102122-kiteworks-did-not-correctly-enforce-which-roles-a-shared-folder","title":"Kiteworks Core incorrect authorization in folder role assignment","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:00.37+00:00","url":"https://junglewise.ai/threats/cve-2026-102122-kiteworks-did-not-correctly-enforce-which-roles-a-shared-folder"},{"cve":"CVE-2026-102120","cvss":8.8,"slug":"cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have","title":"Kiteworks Core privilege escalation through OS command injection","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:00.057+00:00","url":"https://junglewise.ai/threats/cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have"},{"cve":"CVE-2026-102118","cvss":7.8,"slug":"cve-2026-102118-a-local-privilege-escalation-vulnerability-in-kiteworks-could","title":"Kiteworks Core local privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:59.707+00:00","url":"https://junglewise.ai/threats/cve-2026-102118-a-local-privilege-escalation-vulnerability-in-kiteworks-could"},{"cve":"CVE-2026-102117","cvss":7.2,"slug":"cve-2026-102117-on-deployments-where-the-remote-support-capability-is-licensed","title":"Kiteworks Core remote code execution in remote-support functionality","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:59.533+00:00","url":"https://junglewise.ai/threats/cve-2026-102117-on-deployments-where-the-remote-support-capability-is-licensed"},{"cve":"CVE-2026-102115","cvss":9.8,"slug":"cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted","title":"Kiteworks Core authentication bypass in password reset","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:59.18+00:00","url":"https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted"},{"cve":"CVE-2026-102114","cvss":7.2,"slug":"cve-2026-102114-a-command-injection-vulnerability-in-kiteworks-could-allow-a","title":"Kiteworks Core OS command injection","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:58.88+00:00","url":"https://junglewise.ai/threats/cve-2026-102114-a-command-injection-vulnerability-in-kiteworks-could-allow-a"},{"cve":"CVE-2026-102113","cvss":7.8,"slug":"cve-2026-102113-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an","title":"Kiteworks Core local privilege escalation in path handling","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:58.427+00:00","url":"https://junglewise.ai/threats/cve-2026-102113-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an"},{"cve":"CVE-2026-102112","cvss":7.8,"slug":"cve-2026-102112-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an","title":"Kiteworks Core local privilege escalation to root","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:58.267+00:00","url":"https://junglewise.ai/threats/cve-2026-102112-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an"},{"cve":"CVE-2026-102111","cvss":4.9,"slug":"cve-2026-102111-kiteworks-did-not-enforce-the-maximum-permitted-value-for-a","title":"Kiteworks improper validation of configurable security-policy setting","severity":"medium","exploited":false,"published_at":"2026-09-30T21:16:58.137+00:00","url":"https://junglewise.ai/threats/cve-2026-102111-kiteworks-did-not-enforce-the-maximum-permitted-value-for-a"},{"cve":"CVE-2026-102110","cvss":5.9,"slug":"cve-2026-102110-an-endpoint-used-during-initial-appliance-setup-did-not-require","title":"Kiteworks Core missing authentication in setup endpoint","severity":"medium","exploited":false,"published_at":"2026-09-30T21:16:57.99+00:00","url":"https://junglewise.ai/threats/cve-2026-102110-an-endpoint-used-during-initial-appliance-setup-did-not-require"},{"cve":"CVE-2026-102107","cvss":4.6,"slug":"cve-2026-102107-kiteworks-core-contains-a-business-logic-flaw-in-a-kiteworks","title":"Kiteworks Core authorization bypass in file-request feature","severity":"medium","exploited":false,"published_at":"2026-09-30T21:16:57.613+00:00","url":"https://junglewise.ai/threats/cve-2026-102107-kiteworks-core-contains-a-business-logic-flaw-in-a-kiteworks"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":2,"exploited":0,"vulnerabilities":33},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Kiteworks Email Protection Gateway","slug":"email-protection-gateway","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/email-protection-gateway"},{"name":"Kiteworks Secure Data Forms","slug":"secure-data-forms","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/secure-data-forms"},{"name":"Kiteworks Kite","slug":"kite","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/kite"}],"technology":{"hub":true,"name":"Kiteworks Core","slug":"kiteworks-core","vendor":{"hub":true,"name":"Kiteworks","slug":"kiteworks","url":"https://junglewise.ai/threats/vendors/kiteworks"},"aliases":[],"category":"web","description":"Kiteworks Core is a secure file transfer and content management platform.","url":"https://junglewise.ai/threats/technologies/kiteworks-core"},"most_severe":[{"cve":"CVE-2026-102115","cvss":9.8,"slug":"cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted","title":"Kiteworks Core authentication bypass in password reset","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:59.18+00:00","url":"https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted"},{"cve":"CVE-2026-102147","cvss":9.3,"slug":"cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core","title":"Kiteworks Core stored cross-site scripting in administrative interface","severity":"critical","exploited":false,"published_at":"2026-09-30T21:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core"},{"cve":"CVE-2026-102120","cvss":8.8,"slug":"cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have","title":"Kiteworks Core privilege escalation through OS command injection","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:00.057+00:00","url":"https://junglewise.ai/threats/cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have"},{"cve":"CVE-2026-102100","cvss":8.7,"slug":"cve-2026-102100-kiteworks-core-before-version-9-5-0-is-vulnerable-to-stored","title":"Kiteworks Core stored cross-site scripting","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:56.75+00:00","url":"https://junglewise.ai/threats/cve-2026-102100-kiteworks-core-before-version-9-5-0-is-vulnerable-to-stored"},{"cve":"CVE-2026-102092","cvss":8.7,"slug":"cve-2026-102092-kiteworks-core-before-version-9-5-0-is-vulnerable-to-stored","title":"Kiteworks Core stored XSS in shared content preview","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:55.743+00:00","url":"https://junglewise.ai/threats/cve-2026-102092-kiteworks-core-before-version-9-5-0-is-vulnerable-to-stored"},{"cve":"CVE-2026-102126","cvss":8.1,"slug":"cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core","title":"Kiteworks Core stored XSS privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:00.963+00:00","url":"https://junglewise.ai/threats/cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core"},{"cve":"CVE-2026-102101","cvss":8.1,"slug":"cve-2026-102101-kiteworks-core-before-version-9-5-0-is-vulnerable-to","title":"Kiteworks Core deserialization of untrusted data","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:56.88+00:00","url":"https://junglewise.ai/threats/cve-2026-102101-kiteworks-core-before-version-9-5-0-is-vulnerable-to"},{"cve":"CVE-2026-102118","cvss":7.8,"slug":"cve-2026-102118-a-local-privilege-escalation-vulnerability-in-kiteworks-could","title":"Kiteworks Core local privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:59.707+00:00","url":"https://junglewise.ai/threats/cve-2026-102118-a-local-privilege-escalation-vulnerability-in-kiteworks-could"},{"cve":"CVE-2026-102113","cvss":7.8,"slug":"cve-2026-102113-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an","title":"Kiteworks Core local privilege escalation in path handling","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:58.427+00:00","url":"https://junglewise.ai/threats/cve-2026-102113-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an"},{"cve":"CVE-2026-102112","cvss":7.8,"slug":"cve-2026-102112-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an","title":"Kiteworks Core local privilege escalation to root","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:58.267+00:00","url":"https://junglewise.ai/threats/cve-2026-102112-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}