CVE-2026-24750: Kiteworks Secure Data Forms vulnerable to Cross-site Scripting
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24750?
CVE-2026-24750 is considered a high-severity vulnerability due to its potential for remote exploitation via Cross-site Scripting.
How do I fix CVE-2026-24750?
To fix CVE-2026-24750, upgrade to Kiteworks Secure Data Forms version 9.2.1 or later.
What types of attacks can CVE-2026-24750 enable?
CVE-2026-24750 enables attackers to perform Stored Cross-site Scripting attacks through vulnerable forms.
Who is affected by CVE-2026-24750?
CVE-2026-24750 affects all authenticated users using Kiteworks Secure Data Forms prior to version 9.2.1.
What is the main issue with CVE-2026-24750?
The main issue with CVE-2026-24750 is the improper neutralization of input during web page generation, allowing for XSS vulnerabilities.