CVE-2026-102096: Kiteworks Core OS command injection

Q: Who can exploit this issue?

An authenticated Kiteworks Core administrator can exploit it by uploading a crafted configuration package. The provided data does not indicate that unauthenticated or lower-privileged users can trigger the issue.

Q: Which systems are affected?

Kiteworks Core versions before 9.5.0 are affected. Systems running version 9.5.0 or later are not identified as affected by the provided information.

Q: What access could successful exploitation provide?

A successful attacker could cause arbitrary operating-system commands to run on the affected appliance, potentially with elevated privileges. This could affect confidentiality, integrity, and availability.

Published Sep 30, 2026

Updated

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance.

Affected Software

1 affected component

Kiteworks Core OS<9.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kiteworks Core to a version that resolves this vulnerability.
Fixed in 9.5.0

Event History

Sep 30, 2026

CVE Published

via MITRE·08:07 PM

Data Sourced

via MITRE·08:07 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Kiteworks Core administrator can exploit it by uploading a crafted configuration package. The provided data does not indicate that unauthenticated or lower-privileged users can trigger the issue.

Which systems are affected?

Kiteworks Core versions before 9.5.0 are affected. Systems running version 9.5.0 or later are not identified as affected by the provided information.

What access could successful exploitation provide?

A successful attacker could cause arbitrary operating-system commands to run on the affected appliance, potentially with elevated privileges. This could affect confidentiality, integrity, and availability.

CVE-2026-102096: Kiteworks Core OS command injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which systems are affected?

What access could successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which systems are affected?

What access could successful exploitation provide?