CVE-2026-28272CWE-79

Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability

High · published February 27, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-27T20:22Z
EPSS history
Timeline
  • 27 FEB 20:22Z
    Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability
    cvelistv5