{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Kiteworks heeft meerdere kwetsbaarheden verholpen in de Kiteworks productlijn.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden in Kiteworks betreffen diverse componenten en functionaliteiten binnen de producten.\n- Geauthenticeerde beheerders kunnen onder andere misbruik maken van onvoldoende validatie in import- en exportfuncties, wat leidt tot het schrijven van bestanden op willekeurige locaties en het uitvoeren van arbitrary code.\n- Er zijn meerdere gevallen van privilege-escalatie waarbij gebruikers met beperkte rechten hun privileges kunnen verhogen tot systeembeheerder.\n- Verder zijn er kwetsbaarheden die het mogelijk maken om via Server-Side Request Forgery (SSRF) ongeautoriseerde verzoeken naar interne netwerken te sturen, wat toegang tot beschermde interne bronnen kan geven.\n- Cross-site scripting (XSS) kwetsbaarheden maken het mogelijk om kwaadaardige scripts uit te voeren in de context van andere gebruikers, wat sessieovername kan veroorzaken.\n- SQL-injectieproblemen in administratieve functies kunnen leiden tot ongeautoriseerde toegang tot databasegegevens.\n- Daarnaast zijn er kwetsbaarheden in authenticatiemechanismen, waaronder bypasses en het resetten van wachtwoorden zonder juiste verificatie, wat ongeautoriseerde accounttoegang mogelijk maakt.\n- Sommige kwetsbaarheden betreffen ook de cluster- en appliance-omgevingen, waarbij command execution en privilege-escalatie tussen nodes mogelijk is.\n- Verder zijn er problemen met onvoldoende validatie van uploads, configuratiebestanden en certificaattoewijzingen, wat kan leiden tot systeemcompromittering of het onderscheppen van versleutelde communicatie.\n- Ten slotte zijn er kwetsbaarheden die resource exhaustion kunnen veroorzaken, wat de beschikbaarheid van de systemen kan beïnvloeden.\n\nExploitatie van deze kwetsbaarheden vereist in veel gevallen authentificatie met beheerdersrechten, maar er zijn ook kwetsbaarheden die zonder authenticatie kunnen worden misbruikt, met name tijdens de initiële setup of via onbeveiligde interfaces. Omdat kwetsbaarheden die zonder voorafgaande authenticatie kunnen worden misbruikt mogelijk kunnen leiden tot verhoogde rechten, is het niet uitgesloten dat de kwetsbaarheden in keten kunnen worden misbruikt en kunnen leiden tot uitvoer van handelingen onder beheerdersrechten.", "title": "Interpretaties" }, { "category": "description", "text": "Kiteworks heeft updates uitgebracht om de kwetsbaarheden in de Kiteworks productlijn te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "general", "text": "Improper Link Resolution Before File Access ('Link Following')", "title": "CWE-59" }, { "category": "general", "text": "External Control of File Name or Path", "title": "CWE-73" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "title": "CWE-77" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "general", "text": "XML Injection (aka Blind XPath Injection)", "title": "CWE-91" }, { "category": "general", "text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "title": "CWE-93" }, { "category": "general", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "general", "text": "Improper Handling of Case Sensitivity", "title": "CWE-178" }, { "category": "general", "text": "Execution with Unnecessary Privileges", "title": "CWE-250" }, { "category": "general", "text": "Incorrect Privilege Assignment", "title": "CWE-266" }, { "category": "general", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "general", "text": "Unprotected Alternate Channel", "title": "CWE-420" }, { "category": "general", "text": "Unrestricted Upload of File with Dangerous Type", "title": "CWE-434" }, { "category": "general", "text": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "title": "CWE-470" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "URL Redirection to Untrusted Site ('Open Redirect')", "title": "CWE-601" }, { "category": "general", "text": "Improper Restriction of XML External Entity Reference", "title": "CWE-611" }, { "category": "general", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "general", "text": "Weak Password Recovery Mechanism for Forgotten Password", "title": "CWE-640" }, { "category": "general", "text": "Improper Isolation or Compartmentalization", "title": "CWE-653" }, { "category": "general", "text": "Always-Incorrect Control Flow Implementation", "title": "CWE-670" }, { "category": "general", "text": "Reliance on Untrusted Inputs in a Security Decision", "title": "CWE-807" }, { "category": "general", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "general", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "general", "text": "Improper Verification of Source of a Communication Channel", "title": "CWE-940" }, { "category": "general", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "general", "text": "Improper Neutralization of Special Elements Used in a Template Engine", "title": "CWE-1336" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://github.com/kiteworks/security-advisories/security/advisories/" } ], "title": "Kwetsbaarheden verholpen in Kiteworks", "tracking": { "current_release_date": "2026-10-08T11:21:44.504105Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0408", "initial_release_date": "2026-10-08T11:21:44.504105Z", "revision_history": [ { "date": "2026-10-08T11:21:44.504105Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Email Protection Gateway" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "Kiteworks" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-4" } } ], "category": "product_name", "name": "Secure Data Forms" } ], "category": "vendor", "name": "Kiteworks" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-102089", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a path traversal vulnerability in an admin import function that allows authenticated administrators to write files to arbitrary server locations, potentially leading to arbitrary code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102089 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102089.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102089" }, { "cve": "CVE-2026-102090", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site ('Open Redirect')" }, "notes": [ { "category": "other", "text": "URL Redirection to Untrusted Site ('Open Redirect')", "title": "CWE-601" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.1 contain a Content Injection vulnerability in the PDF viewer's URL parameter validation, enabling attackers to display malicious documents within the trusted application domain and potentially enhance phishing attacks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102090 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102090.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102090" }, { "cve": "CVE-2026-102091", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "Kiteworks Secure Data Forms versions prior to 9.5.0 contain a Server-Side Request Forgery vulnerability enabling unauthenticated remote attackers to induce the server to send arbitrary outbound requests and access internal network resources.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102091 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102091.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102091" }, { "cve": "CVE-2026-102092", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain a Stored Cross-site Scripting (XSS) vulnerability enabling authenticated users to execute arbitrary JavaScript in other users' sessions, risking session compromise and account takeover.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102092 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102092.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102092" }, { "cve": "CVE-2026-102093", "notes": [ { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain a privilege management vulnerability allowing authenticated admins with limited role-management permissions to escalate another user's privileges to full system-administrator level.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102093 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102093.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102093" }, { "cve": "CVE-2026-102094", "cwe": { "id": "CWE-470", "name": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')" }, "notes": [ { "category": "other", "text": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "title": "CWE-470" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a vulnerability enabling authenticated administrators with mail-rule configuration privileges to execute unauthorized code via unsafe reflection in the mail-processing pipeline.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102094 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102094.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102094" }, { "cve": "CVE-2026-102095", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 are vulnerable to Server-Side Request Forgery, enabling unauthenticated remote attackers to access internal URLs and potentially expose sensitive data or disrupt internal services.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102095 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102095.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102095" }, { "cve": "CVE-2026-102096", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain an OS Command Injection vulnerability enabling authenticated administrators to execute arbitrary OS commands with potentially elevated privileges via a malicious configuration package upload.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102096 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102096.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102096" }, { "cve": "CVE-2026-102097", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "other", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a vulnerability that permits authenticated administrators to execute arbitrary commands through improperly validated configuration imports, enabling potential remote code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102097 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102097.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102097" }, { "cve": "CVE-2026-102098", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain a stored SQL injection vulnerability in an administrative reporting feature that allows authenticated administrators to access sensitive database information and potentially disrupt service availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102098 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102098.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102098" }, { "cve": "CVE-2026-102099", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain a vulnerability in the administrative export feature that permits authenticated administrators to write files to arbitrary locations on the host, potentially enabling command execution on the appliance.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102099 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102099.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102099" }, { "cve": "CVE-2026-102100", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript, potentially leading to session hijacking and account takeover including privileged accounts.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102100 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102100.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102100" }, { "cve": "CVE-2026-102101", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "description", "text": "Kiteworks Core versions prior to 9.5.0 contain a deserialization vulnerability that could enable remote code execution if an attacker can manipulate input data, though it is not independently exploitable.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102101 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102101.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102101" }, { "cve": "CVE-2026-102102", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability enabling unauthenticated remote attackers to send crafted requests to internal or unintended network targets, risking data exposure and operational disruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102102 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102102.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102102" }, { "cve": "CVE-2026-102103", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability enabling remote attackers to send crafted requests to internal or unintended network destinations, risking data exposure and operational disruption.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102103 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102103.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102103" }, { "cve": "CVE-2026-102104", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability enabling unauthenticated remote attackers to send crafted requests to internal or unintended network destinations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102104 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102104.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102104" }, { "cve": "CVE-2026-102105", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability enabling remote attackers to send crafted requests to internal or unintended network destinations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102105 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102105.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102105" }, { "cve": "CVE-2026-102106", "notes": [ { "category": "description", "text": "An authentication bypass vulnerability in the Kiteworks Email Protection Gateway administrative service enables attackers with valid admin credentials to modify or delete users and domains, potentially locking out legitimate administrators.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102106 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102106.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102106" }, { "cve": "CVE-2026-102107", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "Kiteworks Core contains a business logic flaw in its file-request feature that enables an authenticated user to impersonate another user to request files or information, requiring both the feature to be enabled and the recipient to respond.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102107 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102107.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "baseScore": 4.6, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102107" }, { "cve": "CVE-2026-102108", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "description", "text": "An authenticated administrator with queue-management privileges in Kiteworks Email Protection Gateway can exploit insufficient deserialization validation to execute arbitrary code under the gateway service account.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102108 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102108.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102108" }, { "cve": "CVE-2026-102109", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "description", "text": "A SQL injection vulnerability in Kiteworks Secure Data Forms allows authenticated users to inject SQL via stored account data values, requiring an authenticated session and a specific optional feature for exploitation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102109 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102109.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102109" }, { "cve": "CVE-2026-102110", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "other", "text": "Always-Incorrect Control Flow Implementation", "title": "CWE-670" }, { "category": "description", "text": "An unauthenticated endpoint during initial appliance setup allowed network attackers to repeatedly trigger privileged activation, potentially disrupting setup and leaving the appliance incompletely configured, limited to the first activation window.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102110 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102110.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102110" }, { "cve": "CVE-2026-102111", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "description", "text": "Kiteworks contained a security flaw allowing an authenticated administrator to bypass a configurable security-policy by setting its value outside the allowed range, rendering the control ineffective despite appearing active.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102111 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102111.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102111" }, { "cve": "CVE-2026-102112", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A privilege escalation vulnerability in Kiteworks enables an attacker with local access to an unprivileged backend service account to escalate privileges to root and execute arbitrary commands with highest system privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102112 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102112.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102112" }, { "cve": "CVE-2026-102113", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "other", "text": "Improper Link Resolution Before File Access ('Link Following')", "title": "CWE-59" }, { "category": "description", "text": "A privilege escalation vulnerability in Kiteworks enables an attacker with local unprivileged backend service access to execute arbitrary commands as root by exploiting unsafe filesystem path handling in a privileged routine.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102113 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102113.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102113" }, { "cve": "CVE-2026-102114", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A command injection vulnerability in Kiteworks allows a high-privileged authenticated administrator to execute arbitrary OS commands as root on the affected appliance node, requiring an administrative account with elevated privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102114 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102114.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102114" }, { "cve": "CVE-2026-102115", "cwe": { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password" }, "notes": [ { "category": "other", "text": "Weak Password Recovery Mechanism for Forgotten Password", "title": "CWE-640" }, { "category": "description", "text": "Kiteworks Core contained a critical vulnerability in its password reset process that enabled unauthenticated attackers to reset user passwords and access accounts, including those with administrative privileges, without requiring the reset email link.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102115 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102115.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102115" }, { "cve": "CVE-2026-102116", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "other", "text": "XML Injection (aka Blind XPath Injection)", "title": "CWE-91" }, { "category": "description", "text": "An authenticated administrator of the Kiteworks Email Protection Gateway can exploit a vulnerability to write and execute files outside designated directories, enabling remote code execution with the service account's privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102116 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102116.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102116" }, { "cve": "CVE-2026-102117", "cwe": { "id": "CWE-807", "name": "Reliance on Untrusted Inputs in a Security Decision" }, "notes": [ { "category": "other", "text": "Reliance on Untrusted Inputs in a Security Decision", "title": "CWE-807" }, { "category": "other", "text": "Improper Verification of Source of a Communication Channel", "title": "CWE-940" }, { "category": "description", "text": "An authenticated System Administrator can exploit the licensed remote-support feature to redirect outbound connections, execute OS commands remotely, and potentially achieve remote code execution with local service account privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102117 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102117.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102117" }, { "cve": "CVE-2026-102118", "cwe": { "id": "CWE-250", "name": "Execution with Unnecessary Privileges" }, "notes": [ { "category": "other", "text": "Execution with Unnecessary Privileges", "title": "CWE-250" }, { "category": "other", "text": "Improper Link Resolution Before File Access ('Link Following')", "title": "CWE-59" }, { "category": "description", "text": "A local privilege escalation vulnerability in Kiteworks allows an attacker with low-level access to escalate privileges to root on the appliance.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102118 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102118.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102118" }, { "cve": "CVE-2026-102119", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "An authenticated administrator can exploit a path traversal vulnerability in an optional administrative feature to move files outside the intended directory, potentially enabling arbitrary code execution on the system.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102119 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102119.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102119" }, { "cve": "CVE-2026-102120", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A privilege escalation vulnerability in Kiteworks allows an attacker with code execution on one cluster node to execute OS commands with elevated privileges on another node due to insufficient input validation in internal cluster management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102120 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102120.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102120" }, { "cve": "CVE-2026-102121", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "An unauthenticated form-rendering interface in the Advanced Forms component exposed excessive data, allowing access to the form owner's Kiteworks account profile and deployment configuration details without revealing sensitive credentials.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102121 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102121.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102121" }, { "cve": "CVE-2026-102122", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Kiteworks experienced a security flaw where users with Manager roles on shared folders could improperly escalate privileges by assigning the Owner role due to incorrect role enforcement in the default configuration.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102122 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102122.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102122" }, { "cve": "CVE-2026-102123", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "A vulnerability in the Kiteworks appliance setup interface allows unauthenticated attackers with network access during initial provisioning or non-default configurations to write files outside intended directories, risking appliance integrity and availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102123 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102123.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102123" }, { "cve": "CVE-2026-102124", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "other", "text": "Always-Incorrect Control Flow Implementation", "title": "CWE-670" }, { "category": "description", "text": "A Kiteworks appliance setup interface lacked authentication after initial configuration, enabling unauthenticated network attackers to read and modify setup records such as contact name and email address.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102124 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102124.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102124" }, { "cve": "CVE-2026-102125", "cwe": { "id": "CWE-653", "name": "Improper Isolation or Compartmentalization" }, "notes": [ { "category": "other", "text": "Improper Isolation or Compartmentalization", "title": "CWE-653" }, { "category": "description", "text": "A vulnerability in the Kiteworks appliance document conversion sandbox allows code execution to escape confinement, potentially accessing or altering application data and configuration with service account privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102125 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102125.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102125" }, { "cve": "CVE-2026-102126", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "A stored cross-site scripting (XSS) vulnerability in Kiteworks Core enables a low-privileged administrator to execute arbitrary JavaScript within a System Administrator's session, potentially escalating privileges to full tenant administrative control.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102126 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102126.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102126" }, { "cve": "CVE-2026-102127", "cwe": { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference" }, "notes": [ { "category": "other", "text": "Improper Restriction of XML External Entity Reference", "title": "CWE-611" }, { "category": "description", "text": "A remote, unauthenticated attacker can exploit an XML parser vulnerability in Kiteworks Email Protection Gateway to access and exfiltrate sensitive files, including cryptographic keys and credentials, via external entity references.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102127 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102127.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102127" }, { "cve": "CVE-2026-102128", "notes": [ { "category": "description", "text": "A vulnerability in Kiteworks Email Protection Gateway enabled unauthenticated remote attackers to impersonate users and gain control over platform accounts, posing significant security risks.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102128 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102128.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102128" }, { "cve": "CVE-2026-102129", "cwe": { "id": "CWE-266", "name": "Incorrect Privilege Assignment" }, "notes": [ { "category": "other", "text": "Incorrect Privilege Assignment", "title": "CWE-266" }, { "category": "description", "text": "A vulnerability in Kiteworks Core's user-provisioning interface allowed administrators with limited role-change permissions to escalate their privileges to full system-administrator level without proper entitlement verification.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102129 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102129.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102129" }, { "cve": "CVE-2026-102130", "cwe": { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type" }, "notes": [ { "category": "other", "text": "Unrestricted Upload of File with Dangerous Type", "title": "CWE-434" }, { "category": "other", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "description", "text": "Kiteworks Email Protection Gateway contains a vulnerability allowing an authenticated administrator to exploit insufficient validation of uploaded backups to execute arbitrary code on the gateway.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102130 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102130.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102130" }, { "cve": "CVE-2026-102131", "cwe": { "id": "CWE-178", "name": "Improper Handling of Case Sensitivity" }, "notes": [ { "category": "other", "text": "Improper Handling of Case Sensitivity", "title": "CWE-178" }, { "category": "other", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "description", "text": "A configuration validation flaw in Kiteworks Email Protection Gateway allowed an authenticated administrator to execute arbitrary code as the gateway service account by exploiting unrecognized input forms.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102131 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102131.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102131" }, { "cve": "CVE-2026-102132", "notes": [ { "category": "description", "text": "A vulnerability in Kiteworks Core's administrative import function allowed delegated administrators with limited permissions to escalate their privileges to full system administrator level without approval.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102132 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102132.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102132" }, { "cve": "CVE-2026-102133", "cwe": { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "title": "CWE-77" }, { "category": "description", "text": "A vulnerability in Kiteworks Core's optional repository-connector feature allows authenticated system administrators to execute arbitrary commands with service account privileges, requiring network access to an attacker-controlled system.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102133 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102133.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102133" }, { "cve": "CVE-2026-102134", "cwe": { "id": "CWE-420", "name": "Unprotected Alternate Channel" }, "notes": [ { "category": "other", "text": "Unprotected Alternate Channel", "title": "CWE-420" }, { "category": "description", "text": "Kiteworks Core failed to enforce gateway-level API security controls on all requests authenticated via its central authentication service, enabling authenticated users to access REST API functions without proper session enforcement.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102134 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102134.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102134" }, { "cve": "CVE-2026-102135", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "description", "text": "A vulnerability in Kiteworks Email Protection Gateway with database replication enabled allows a trusted cluster party to execute code as the gateway service account via a crafted serialized object, requiring control of a trusted peer or admin access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102135 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102135.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102135" }, { "cve": "CVE-2026-102136", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "title": "CWE-93" }, { "category": "description", "text": "In multi-node deployments, an attacker with code execution on one node can exploit insufficient validation in the internal cluster interface to execute OS commands on another node, limited to an unprivileged service account.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102136 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102136.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102136" }, { "cve": "CVE-2026-102137", "cwe": { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type" }, "notes": [ { "category": "other", "text": "Unrestricted Upload of File with Dangerous Type", "title": "CWE-434" }, { "category": "description", "text": "An authenticated administrator can bypass content validation during file uploads on the appliance, potentially storing dangerous files, though code execution requires an additional vulnerability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102137 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102137.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L", "baseScore": 4.1, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102137" }, { "cve": "CVE-2026-102138", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "An authenticated administrator on a node with the licensed gateway role can exploit insufficient validation of connector URLs to cause the server to send requests to internal network services, potentially leading to unauthorized internal access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102138 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102138.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "baseScore": 3.3, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102138" }, { "cve": "CVE-2026-102139", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "A vulnerability in Kiteworks Email Protection Gateway's large file exchange feature allowed authenticated users to bypass authorization checks and access email package contents they were not permitted to send or receive.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102139 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102139.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102139" }, { "cve": "CVE-2026-102140", "notes": [ { "category": "description", "text": "An authenticated administrator could exploit a vulnerability in the administrative import process where only the file header is validated, potentially allowing unverified or forged data to be processed and compromising data integrity.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102140 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102140.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102140" }, { "cve": "CVE-2026-102141", "cwe": { "id": "CWE-73", "name": "External Control of File Name or Path" }, "notes": [ { "category": "other", "text": "External Control of File Name or Path", "title": "CWE-73" }, { "category": "description", "text": "A vulnerability in Kiteworks Core cluster-management allows an attacker with root access on one node to execute files as root on another node, requiring backend root access and a pending patch on the target node.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102141 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102141.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L", "baseScore": 6.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102141" }, { "cve": "CVE-2026-102142", "cwe": { "id": "CWE-1336", "name": "Improper Neutralization of Special Elements Used in a Template Engine" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements Used in a Template Engine", "title": "CWE-1336" }, { "category": "description", "text": "An authenticated System Administrator can exploit a vulnerability in the Kiteworks appliance's notification template engine to execute arbitrary operating system commands via a specially crafted template.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102142 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102142.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102142" }, { "cve": "CVE-2026-102143", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "other", "text": "Unrestricted Upload of File with Dangerous Type", "title": "CWE-434" }, { "category": "description", "text": "An unauthenticated attacker can upload malicious files to the appliance filesystem via an improperly authenticated administrative upload handler, though this does not directly enable code execution without another vulnerability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102143 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102143.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102143" }, { "cve": "CVE-2026-102144", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger expensive server-side operations, causing a partial denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102144 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102144.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102144" }, { "cve": "CVE-2026-102145", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "title": "CWE-93" }, { "category": "description", "text": "An authenticated administrator can exploit the server to access internal network services not intended for exposure via the interface, though this does not result in code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102145 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102145.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "baseScore": 6.6, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102145" }, { "cve": "CVE-2026-102146", "cwe": { "id": "CWE-73", "name": "External Control of File Name or Path" }, "notes": [ { "category": "other", "text": "External Control of File Name or Path", "title": "CWE-73" }, { "category": "description", "text": "An authenticated Email Protection Gateway administrator with limited permissions can exploit a vulnerability to write attacker-controlled files to arbitrary locations accessible by the service account, risking unauthorized modification or disruption of application files and configurations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102146 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102146.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102146" }, { "cve": "CVE-2026-102147", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "A stored cross-site scripting (XSS) vulnerability in Kiteworks Core allows unauthenticated attackers to execute arbitrary JavaScript in administrator sessions, potentially enabling full administrative control and creation of new admin accounts.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102147 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102147.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "baseScore": 9.3, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102147" }, { "cve": "CVE-2026-102149", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "A vulnerability in Kiteworks Email Protection Gateway allowed attackers to assign certificates to other users' accounts, risking unauthorized access and compromising encrypted email confidentiality and integrity.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102149 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102149.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102149" }, { "cve": "CVE-2026-102150", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "An unauthenticated function in the Kiteworks Advanced Forms component permitted limited internal service operations without exposing user accounts, stored files, or form submissions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "self", "summary": "CVE-2026-102150 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102150.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] } ], "title": "CVE-2026-102150" } ] }