# Kiteworks Core vulnerabilities Source: https://junglewise.ai/threats/technologies/kiteworks-core Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/kiteworks-core.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in Kiteworks Core: 0 in the last 7 days and 33 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102147, was published on 30 September 2026. Nothing in the last four weeks, down from 33 vulnerabilities in the four before. 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 33 - All time: 33 (2 critical, 0 exploited in the wild) ## About Kiteworks Core Kiteworks Core is a secure file transfer and content management platform. ## Latest Kiteworks Core vulnerabilities - [CVE-2026-102147: Kiteworks Core stored cross-site scripting in administrative interface](https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (critical, CVSS 9.3, published 30 Sep 2026) - [CVE-2026-102145: Kiteworks Core SSRF via CRLF injection](https://junglewise.ai/threats/cve-2026-102145-an-authenticated-administrator-could-cause-the-server-to-issue) (medium, CVSS 6.6, published 30 Sep 2026) - [CVE-2026-102142: Kiteworks Core remote code execution in notification template](https://junglewise.ai/threats/cve-2026-102142-a-system-notification-template-on-the-kiteworks-appliance-was) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102141: Kiteworks Core privilege escalation in cluster-management operations](https://junglewise.ai/threats/cve-2026-102141-two-kiteworks-core-cluster-management-operations-did-not) (medium, CVSS 6.7, published 30 Sep 2026) - [CVE-2026-102140: Kiteworks Core insufficient verification of data authenticity in import](https://junglewise.ai/threats/cve-2026-102140-an-authenticated-administrator-could-initiate-an-administrative) (medium, CVSS 4.9, published 30 Sep 2026) - [CVE-2026-102137: Kiteworks Core unrestricted upload of dangerous file type](https://junglewise.ai/threats/cve-2026-102137-an-authenticated-administrator-could-bypass-the-content) (medium, CVSS 4.1, published 30 Sep 2026) - [CVE-2026-102136: Kiteworks Core command execution through configuration injection](https://junglewise.ai/threats/cve-2026-102136-in-multi-node-deployments-an-attacker-who-had-already-obtained) (medium, CVSS 6.3, published 30 Sep 2026) - [CVE-2026-102134: Kiteworks Core gateway-level API security controls bypass](https://junglewise.ai/threats/cve-2026-102134-kiteworks-core-did-not-apply-its-gateway-level-api-security) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-102133: Kiteworks Core command injection in repository connector](https://junglewise.ai/threats/cve-2026-102133-an-optional-separately-licensed-repository-connector-feature-in) (medium, CVSS 6.6, published 30 Sep 2026) - [CVE-2026-102132: Kiteworks Core privilege escalation in administrative import](https://junglewise.ai/threats/cve-2026-102132-an-administrative-import-function-in-kiteworks-core-did-not) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102129: Kiteworks Core privilege escalation in user-provisioning interface](https://junglewise.ai/threats/cve-2026-102129-a-user-provisioning-interface-in-kiteworks-core-did-not-verify) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102126: Kiteworks Core stored XSS privilege escalation](https://junglewise.ai/threats/cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (high, CVSS 8.1, published 30 Sep 2026) - [CVE-2026-102124: Kiteworks Core authentication bypass in setup interface](https://junglewise.ai/threats/cve-2026-102124-a-kiteworks-appliance-setup-interface-did-not-enforce) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-102123: Kiteworks Core path traversal in setup interface](https://junglewise.ai/threats/cve-2026-102123-a-kiteworks-appliance-setup-interface-did-not-confine-a-user) (high, CVSS 7.4, published 30 Sep 2026) - [CVE-2026-102122: Kiteworks Core incorrect authorization in folder role assignment](https://junglewise.ai/threats/cve-2026-102122-kiteworks-did-not-correctly-enforce-which-roles-a-shared-folder) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-102120: Kiteworks Core privilege escalation through OS command injection](https://junglewise.ai/threats/cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-102118: Kiteworks Core local privilege escalation](https://junglewise.ai/threats/cve-2026-102118-a-local-privilege-escalation-vulnerability-in-kiteworks-could) (high, CVSS 7.8, published 30 Sep 2026) - [CVE-2026-102117: Kiteworks Core remote code execution in remote-support functionality](https://junglewise.ai/threats/cve-2026-102117-on-deployments-where-the-remote-support-capability-is-licensed) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102115: Kiteworks Core authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-102114: Kiteworks Core OS command injection](https://junglewise.ai/threats/cve-2026-102114-a-command-injection-vulnerability-in-kiteworks-could-allow-a) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102113: Kiteworks Core local privilege escalation in path handling](https://junglewise.ai/threats/cve-2026-102113-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an) (high, CVSS 7.8, published 30 Sep 2026) - [CVE-2026-102112: Kiteworks Core local privilege escalation to root](https://junglewise.ai/threats/cve-2026-102112-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an) (high, CVSS 7.8, published 30 Sep 2026) - [CVE-2026-102111: Kiteworks improper validation of configurable security-policy setting](https://junglewise.ai/threats/cve-2026-102111-kiteworks-did-not-enforce-the-maximum-permitted-value-for-a) (medium, CVSS 4.9, published 30 Sep 2026) - [CVE-2026-102110: Kiteworks Core missing authentication in setup endpoint](https://junglewise.ai/threats/cve-2026-102110-an-endpoint-used-during-initial-appliance-setup-did-not-require) (medium, CVSS 5.9, published 30 Sep 2026) - [CVE-2026-102107: Kiteworks Core authorization bypass in file-request feature](https://junglewise.ai/threats/cve-2026-102107-kiteworks-core-contains-a-business-logic-flaw-in-a-kiteworks) (medium, CVSS 4.6, published 30 Sep 2026) ## Most severe Kiteworks Core vulnerabilities - [CVE-2026-102115: Kiteworks Core authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-102147: Kiteworks Core stored cross-site scripting in administrative interface](https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (critical, CVSS 9.3, published 30 Sep 2026) - [CVE-2026-102120: Kiteworks Core privilege escalation through OS command injection](https://junglewise.ai/threats/cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-102100: Kiteworks Core stored cross-site scripting](https://junglewise.ai/threats/cve-2026-102100-kiteworks-core-before-version-9-5-0-is-vulnerable-to-stored) (high, CVSS 8.7, published 30 Sep 2026) - [CVE-2026-102092: Kiteworks Core stored XSS in shared content preview](https://junglewise.ai/threats/cve-2026-102092-kiteworks-core-before-version-9-5-0-is-vulnerable-to-stored) (high, CVSS 8.7, published 30 Sep 2026) - [CVE-2026-102126: Kiteworks Core stored XSS privilege escalation](https://junglewise.ai/threats/cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (high, CVSS 8.1, published 30 Sep 2026) - [CVE-2026-102101: Kiteworks Core deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-102101-kiteworks-core-before-version-9-5-0-is-vulnerable-to) (high, CVSS 8.1, published 30 Sep 2026) - [CVE-2026-102118: Kiteworks Core local privilege escalation](https://junglewise.ai/threats/cve-2026-102118-a-local-privilege-escalation-vulnerability-in-kiteworks-could) (high, CVSS 7.8, published 30 Sep 2026) - [CVE-2026-102113: Kiteworks Core local privilege escalation in path handling](https://junglewise.ai/threats/cve-2026-102113-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an) (high, CVSS 7.8, published 30 Sep 2026) - [CVE-2026-102112: Kiteworks Core local privilege escalation to root](https://junglewise.ai/threats/cve-2026-102112-a-privilege-escalation-vulnerability-in-kiteworks-could-allow-an) (high, CVSS 7.8, published 30 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 33 vulnerabilities in the four before. 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 33 | 2 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Kiteworks technologies - [Kiteworks Email Protection Gateway](https://junglewise.ai/threats/technologies/email-protection-gateway): 22 vulnerabilities - [Kiteworks Secure Data Forms](https://junglewise.ai/threats/technologies/secure-data-forms): 13 vulnerabilities - [Kiteworks Kite](https://junglewise.ai/threats/technologies/kite): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Kiteworks Core vulnerabilities", https://junglewise.ai/threats/technologies/kiteworks-core, 9 November 2026.