CVE-2026-102147CWE-79cross-site-scripting

CVE-2026-102147

Critical · published October 1, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-01T01:17Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.19.5.1
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 20:09Z
    Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
    cvelistv5