CVE-2026-102147

9.3 CRITICALpublic exploit available

Published 2026-09-30 · Updated 2026-10-01

AI risk analysis

Summary: A stored cross-site scripting (XSS) vulnerability in Kiteworks Core allows unauthenticated attackers to inject malicious JavaScript, potentially gaining full administrative control.
Exploitability: Exploitation is relatively straightforward for an attacker who can control the content stored, requiring only that an administrator view the crafted page.
Blast radius: If exploited, the attacker could gain full administrative control, including the ability to create new administrative accounts, severely impacting system security.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the fixed version 2.590 or later.

xsswebadmin-bypass

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.