CVE-2026-102112CWE-269CWE-78command-injectionprivilege-escalation

CVE-2026-102112

High · published October 1, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.2th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-01T01:16Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.09.5.0
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-658c-86vw-g9hf · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 20:20Z
    Kiteworks Core Local Privilege Escalation
    cvelistv5