CVE-2026-102101: Kiteworks Core deserialization of untrusted data
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Coreto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Kiteworks Core versions before 9.5.0 are affected. The provided information does not identify any configuration-specific exclusions.
What must an attacker be able to do to exploit this issue?
An attacker must first be able to influence the data that reaches the affected deserialization process. The issue is not exploitable on its own without that prerequisite.
What is the potential impact if exploitation succeeds?
Unsafe deserialization of crafted data could potentially result in remote code execution on the Kiteworks appliance.