CVE-2026-102147: Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

Published Sep 30, 2026

Updated

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

Affected Software

1 affected component

Kiteworks Core

Event History

Sep 30, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker does not need authentication and can store crafted content through the vulnerable functionality. Exploitation requires an administrator to later view the affected page, causing the stored JavaScript to run in that administrator's authenticated session.

Who is exposed to account takeover?

Kiteworks Core administrators who view affected pages containing attacker-supplied stored content are directly exposed. A successful attack could give the attacker full administrative control, including the ability to create a new administrative account.

CVE-2026-102147: Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to account takeover?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to account takeover?