CVE-2026-102111: Kiteworks Core Improper Validation of Specified Quantity in Input
Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative interface and audit log, allowing it to be silently rendered ineffective.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator can exploit it by configuring the affected security-policy setting with a value above its permitted maximum. The provided information does not indicate that unauthenticated or lower-privileged users can do so.
What is the practical impact of a successful exploit?
The associated security control can be silently disabled because it never activates, even though the administrative interface and audit log continue to show it as enabled. This can undermine the integrity of the affected policy enforcement.
How can administrators identify whether they are affected?
Review the configured value for the affected configurable security-policy setting and verify that it is within its intended maximum range. Do not rely solely on the interface or audit log status, because those may report the control as enabled when it is ineffective.