CVE-2026-102141: Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write…

PriorityP430medium6.7CVSS 3.1

AVLACHPRHUINSCCLIHAL

EPSS

0.10%

0.9th percentile

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kiteworks	core	< 9.5.1	9.5.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.