NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Kiteworks
view advisory published 2026-10-08
Kiteworks heeft meerdere kwetsbaarheden verholpen in de Kiteworks productlijn.
01
describes (61)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-102150US | —OT elevated | — | ||
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of intern… | ||||
| CVE-2026-102149US | —OT elevated | — | ||
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with anot… | ||||
| CVE-2026-102147US | — | — | ||
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the auth… | ||||
| CVE-2026-102146US | — | — | ||
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations access… | ||||
| CVE-2026-102145US | — | — | ||
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface.… | ||||
| CVE-2026-102144US | —OT elevated | — | ||
A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side ope… | ||||
| CVE-2026-102143US | —OT elevated | — | ||
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not prop… | ||||
| CVE-2026-102142US | — | — | ||
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated Syste… | ||||
| CVE-2026-102141US | — | — | ||
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto a… | ||||
| CVE-2026-102140US | —OT elevated | — | ||
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rath… | ||||
| CVE-2026-102139US | —OT elevated | — | ||
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package bein… | ||||
| CVE-2026-102138US | — | — | ||
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient valida… | ||||
| CVE-2026-102137US | — | — | ||
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did… | ||||
| CVE-2026-102136US | — | — | ||
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written int… | ||||
| CVE-2026-102135US | — | — | ||
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized wit… | ||||
| CVE-2026-102134US | — | — | ||
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user cou… | ||||
| CVE-2026-102133US | — | — | ||
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external comma… | ||||
| CVE-2026-102132US | — | — | ||
An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A… | ||||
| CVE-2026-102131US | — | — | ||
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated admini… | ||||
| CVE-2026-102130US | — | — | ||
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An auth… | ||||
showing 20 of 61
02
references
External citations — patches, advisories, analysis.
- Referenceexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan