CVE-2026-102125
published 2026-09-30CVE-2026-102125: The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that…
PriorityP349high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.13%
2.1th percentile
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kiteworks | core | < 9.5.0 | 9.5.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Kiteworks up to 9.4.x privileges management
vuldb·2026-09-30·CVSS 8.8
CVE-2026-102125 [HIGH] Kiteworks up to 9.4.x privileges management
A vulnerability was found in Kiteworks up to 9.4.x. It has been classified as very critical. Impacted is an unknown function. This manipulation causes improper privilege management.
This vulnerability is tracked as CVE-2026-102125. The attack is restricted to local execution. No exploit exists.
Upgrading the affected component is recommended.
GHSA
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.
ghsa_unreviewed·2026-09-30
CVE-2026-102125 [HIGH] CWE-653 The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-30
Published