CVE-2026-24754: Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Secure Data Formsto a version that resolves this vulnerability.Fixed in 9.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24754?
The severity of CVE-2026-24754 is rated as medium with a score of 5.4.
How do I fix CVE-2026-24754?
To mitigate CVE-2026-24754, upgrade Kiteworks to version 9.3.0 or later.
What kind of vulnerability is CVE-2026-24754?
CVE-2026-24754 is a stored cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-24754?
An authenticated attacker can exploit CVE-2026-24754 to execute arbitrary JavaScript code.
What impact does CVE-2026-24754 have on users?
CVE-2026-24754 can allow attackers to execute scripts in other users' sessions, potentially compromising their data.