CVE-2026-28269: Kiteworks Core has an OS Command Injection
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28269?
CVE-2026-28269 is considered to have a high severity due to the potential for OS command injection allowing arbitrary file output redirection.
How do I fix CVE-2026-28269?
To mitigate CVE-2026-28269, upgrade Kiteworks Core to version 9.2.0 or later where the vulnerability has been resolved.
Who is affected by CVE-2026-28269?
CVE-2026-28269 affects all users of Kiteworks Core prior to version 9.2.0.
What can attackers do with CVE-2026-28269?
Attackers can exploit CVE-2026-28269 to execute arbitrary commands and potentially overwrite critical files on the server.
When was CVE-2026-28269 disclosed?
CVE-2026-28269 was disclosed prior to the release of Kiteworks Core version 9.2.0, prompting the need for immediate user action.