CVE-2026-102120

8.8 Élevée

Publiée le 30/09/2026 à 23:17 · Modifiée le 07/10/2026 à 15:58 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in an internal cluster management function let attacker-supplied values reach a privileged execution context; exploitation requires existing access to a node in the cluster, and the affected function is not reachable from outside the cluster.

Traduire en français

Produits concernés

Kiteworks Core
Accellion kiteworks

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78
CWE-269

Références

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m968-434m-rgwp Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories