Kiteworks Security-Advisories vulnerabilities

CVE-2026-28269 [HIGH] CWE-78 CVE-2026-28269: Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks comma Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.

CVE-2025-53900 [HIGH] CWE-267 CVE-2025-53900: Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourab Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

CVE-2025-53939 [HIGH] CWE-20 CVE-2025-53939: Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when ma Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.

CVE-2026-28270 [HIGH] CWE-434 CVE-2026-28270: Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks conf Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

CVE-2025-53896 [HIGH] CWE-613 CVE-2025-53896: Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kite Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.

CVE-2025-53899 [HIGH] CWE-941 CVE-2025-53899: Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an

CVE-2026-28271 [MEDIUM] CWE-350 CVE-2026-28271: Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks conf Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.

CVE-2025-53897 [MEDIUM] CWE-352 CVE-2025-53897: Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerab Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.

CVE-2026-24754 [MEDIUM] CWE-79 CVE-2026-24754: Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kit Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVE-2026-28272 [MEDIUM] CWE-79 CVE-2026-28272: Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Emai Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.