Veille CVE

Jeudi 8 octobre 2026

4 CVE

Critique 0 Élevée 2 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Kiteworks Core » ✕
  1. CVE-2026-102133 6.6 Moyenne

    Kiteworks Core · Accellion kiteworks

    An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.

  2. CVE-2026-102129 7.2 Élevée

    Kiteworks Core · Accellion kiteworks

    A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

  3. CVE-2026-102125 8.8 Élevée

    Kiteworks Core · Accellion kiteworks

    The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.

  4. CVE-2026-102124 6.5 Moyenne

    Kiteworks Core · Accellion kiteworks

    A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.