CVE-2026-102115

Summary

The flaw in Kiteworks Core allows unauthenticated attackers to reset a user's password by exploiting a parameter validation issue, potentially gaining full access to the account, including administrative privileges.

Exploitability

Exploitation is relatively straightforward for attackers who know the user's email address, as no additional access to the reset link is required.

Blast radius

If exploited, the impact could be severe, as it allows unauthorized access to potentially administrative accounts, leading to data breaches or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Kiteworks Core version 2.590 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.