CVE-2026-102091CWE-918ssrf

CVE-2026-102091

High · published October 1, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-01T01:16Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.09.5.0
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m8mj-m4fv-jmrh · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 20:05Z
    Kiteworks Secure Data Forms server-side request forgery
    cvelistv5