CVE-2026-102150: Kiteworks Secure Data Forms Missing Authentication for Critical Function
Published Sep 30, 2026
·Updated
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.
Affected Software
2 affected components
Kiteworks Secure Data Forms
Accellion Kiteworks>=9.3.0<9.5.1
Event History
Sep 30, 2026
CVE Published
via MITRE·08:09 PM
Data Sourced
via MITRE·08:09 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What could an unauthenticated attacker do through the exposed function?
They could potentially perform a limited set of internal service operations on the Kiteworks platform. The available information does not indicate that this provided access to user accounts, stored files, or form submissions.
2
Is user interaction or an existing account required for exploitation?
No. The reported vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.