# Kiteworks vulnerabilities Source: https://junglewise.ai/threats/vendors/kiteworks Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/kiteworks.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 70 vulnerabilities in Kiteworks: 0 in the last 7 days and 60 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102150, was published on 30 September 2026. Nothing in the last four weeks, down from 60 vulnerabilities in the four before. 0 critical against 9. 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 60 - All time: 70 (9 critical, 0 exploited in the wild) ## About Kiteworks Kiteworks (formerly Accellion) provides a secure file sharing and governance platform for sensitive content communications. ## Latest Kiteworks vulnerabilities - [CVE-2026-102150: Kiteworks Secure Data Forms authentication bypass in Advanced Forms](https://junglewise.ai/threats/cve-2026-102150-a-function-in-the-kiteworks-advanced-forms-component-was) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102149: Kiteworks Email Protection Gateway improper access control on certificate assignment](https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict) (critical, CVSS 9.4, published 30 Sep 2026) - [CVE-2026-102147: Kiteworks Core stored cross-site scripting in administrative interface](https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (critical, CVSS 9.3, published 30 Sep 2026) - [CVE-2026-102146: Kiteworks Email Protection Gateway arbitrary file write via template injection](https://junglewise.ai/threats/cve-2026-102146-an-authenticated-email-protection-gateway-administrator-holding) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-102145: Kiteworks Core SSRF via CRLF injection](https://junglewise.ai/threats/cve-2026-102145-an-authenticated-administrator-could-cause-the-server-to-issue) (medium, CVSS 6.6, published 30 Sep 2026) - [CVE-2026-102144: Kiteworks Email Protection Gateway resource exhaustion](https://junglewise.ai/threats/cve-2026-102144-a-resource-exhaustion-vulnerability-in-kiteworks-email) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-102143: Kiteworks Email Protection Gateway unauthenticated file upload](https://junglewise.ai/threats/cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-102142: Kiteworks Core remote code execution in notification template](https://junglewise.ai/threats/cve-2026-102142-a-system-notification-template-on-the-kiteworks-appliance-was) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102141: Kiteworks Core privilege escalation in cluster-management operations](https://junglewise.ai/threats/cve-2026-102141-two-kiteworks-core-cluster-management-operations-did-not) (medium, CVSS 6.7, published 30 Sep 2026) - [CVE-2026-102140: Kiteworks Core insufficient verification of data authenticity in import](https://junglewise.ai/threats/cve-2026-102140-an-authenticated-administrator-could-initiate-an-administrative) (medium, CVSS 4.9, published 30 Sep 2026) - [CVE-2026-102139: Kiteworks Email Protection Gateway authorization bypass in large file exchange](https://junglewise.ai/threats/cve-2026-102139-an-authorization-check-in-the-large-file-exchange-feature-of) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-102137: Kiteworks Core unrestricted upload of dangerous file type](https://junglewise.ai/threats/cve-2026-102137-an-authenticated-administrator-could-bypass-the-content) (medium, CVSS 4.1, published 30 Sep 2026) - [CVE-2026-102136: Kiteworks Core command execution through configuration injection](https://junglewise.ai/threats/cve-2026-102136-in-multi-node-deployments-an-attacker-who-had-already-obtained) (medium, CVSS 6.3, published 30 Sep 2026) - [CVE-2026-102135: Kiteworks Email Protection Gateway deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-102135-on-a-kiteworks-email-protection-gateway-cluster-with-database) (medium, CVSS 6.6, published 30 Sep 2026) - [CVE-2026-102134: Kiteworks Core gateway-level API security controls bypass](https://junglewise.ai/threats/cve-2026-102134-kiteworks-core-did-not-apply-its-gateway-level-api-security) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-102133: Kiteworks Core command injection in repository connector](https://junglewise.ai/threats/cve-2026-102133-an-optional-separately-licensed-repository-connector-feature-in) (medium, CVSS 6.6, published 30 Sep 2026) - [CVE-2026-102132: Kiteworks Core privilege escalation in administrative import](https://junglewise.ai/threats/cve-2026-102132-an-administrative-import-function-in-kiteworks-core-did-not) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102131: Kiteworks Email Protection Gateway code injection via case sensitivity bypass](https://junglewise.ai/threats/cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102130: Kiteworks Email Protection Gateway arbitrary code execution in backup validation](https://junglewise.ai/threats/cve-2026-102130-kiteworks-email-protection-gateway-did-not-sufficiently-validate) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102129: Kiteworks Core privilege escalation in user-provisioning interface](https://junglewise.ai/threats/cve-2026-102129-a-user-provisioning-interface-in-kiteworks-core-did-not-verify) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102128: Kiteworks Email Protection Gateway improper authentication](https://junglewise.ai/threats/cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-102127: Kiteworks Email Protection Gateway XXE in XML parser](https://junglewise.ai/threats/cve-2026-102127-an-xml-parser-used-by-kiteworks-email-protection-gateway-did-not) (high, CVSS 7, published 30 Sep 2026) - [CVE-2026-102126: Kiteworks Core stored XSS privilege escalation](https://junglewise.ai/threats/cve-2026-102126-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (high, CVSS 8.1, published 30 Sep 2026) - [CVE-2026-102125: Kiteworks appliance sandbox escape in document conversion](https://junglewise.ai/threats/cve-2026-102125-the-sandbox-that-isolates-document-conversion-on-a-kiteworks) (high, CVSS 8.8, published 30 Sep 2026) - [CVE-2026-102124: Kiteworks Core authentication bypass in setup interface](https://junglewise.ai/threats/cve-2026-102124-a-kiteworks-appliance-setup-interface-did-not-enforce) (medium, CVSS 6.5, published 30 Sep 2026) ## Most severe Kiteworks vulnerabilities - [CVE-2026-102115: Kiteworks Core authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-102149: Kiteworks Email Protection Gateway improper access control on certificate assignment](https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict) (critical, CVSS 9.4, published 30 Sep 2026) - [CVE-2026-102147: Kiteworks Core stored cross-site scripting in administrative interface](https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core) (critical, CVSS 9.3, published 30 Sep 2026) - [CVE-2026-102106: Kiteworks Email Protection Gateway auth bypass in administrative service](https://junglewise.ai/threats/cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102105: Kiteworks Email Protection Gateway SSRF](https://junglewise.ai/threats/cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102104: Kiteworks Email Protection Gateway server-side request forgery](https://junglewise.ai/threats/cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102103: Kiteworks Email Protection Gateway SSRF in certificate revocation list handling](https://junglewise.ai/threats/cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102102: Kiteworks Email Protection Gateway Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102095: Kiteworks Email Protection Gateway server-side request forgery](https://junglewise.ai/threats/cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102125: Kiteworks appliance sandbox escape in document conversion](https://junglewise.ai/threats/cve-2026-102125-the-sandbox-that-isolates-document-conversion-on-a-kiteworks) (high, CVSS 8.8, published 30 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 60 vulnerabilities in the four before. 0 critical against 9. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 60 | 9 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Kiteworks technologies - [Kiteworks Core](https://junglewise.ai/threats/technologies/kiteworks-core): 33 vulnerabilities - [Kiteworks Email Protection Gateway](https://junglewise.ai/threats/technologies/email-protection-gateway): 22 vulnerabilities - [Kiteworks Secure Data Forms](https://junglewise.ai/threats/technologies/secure-data-forms): 13 vulnerabilities - [Kiteworks Kite](https://junglewise.ai/threats/technologies/kite): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Kiteworks vulnerabilities", https://junglewise.ai/threats/vendors/kiteworks, 9 November 2026.