CVE-2026-102124: Kiteworks Core Missing Authentication for Critical Function
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Kiteworks appliances are exposed if an attacker has network access to the appliance and can reach its setup interface after initial configuration has completed.
What can an unauthenticated attacker do?
An attacker can read and modify a limited set of setup records without authentication, including the contact name and email address collected during initial configuration.
Is user interaction or existing access required for exploitation?
No. The issue is remotely reachable over the network and requires neither prior privileges nor user interaction.