Patch Forecast
Amber warning
Patch this week.

CVE-2026-102101

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data

Risk score
61/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.9%
Published
30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker firs…
Affected
Accellion Kiteworks before 9.5.0
Fix
Upgrade Accellion Kiteworks to 9.5.0 or later.
Exploitation
No known exploitation

Story map

Story map: Accellion KiteworksTHE FLAWSTHE FIXCVE-2026-102101Kiteworks Core before version9.5.0 is vulnerable toDeserialization of Untrusted…CVSS 8.1 · EPSS 1%CVE-2026-102115Kiteworks Core did notcorrectly validate a parametersubmitted to the password…CVSS 9.8 · EPSS 1%CVE-2026-102106Authentication bypassCVSS 9.1 · EPSS 1%CVE-2026-102102Server-side request forgerycan lead to informationdisclosureCVSS 9.1 · EPSS 1%Upgrade Accellion Kiteworks9.5.0or later on your release lineWho is exposedAccellion KiteworksAMBER · PATCH THIS WEEKAccellionKiteworksKiteworks Core did notcorrectly validate a parametersubmitted to the passwordreset workflow. Anunauthenticated attacker whoknew the email address of a userwith a locally stored password…Where it standsNo known exploitationCONNECTS TOSame weaknessUnsafe deserialisation (CWE-502)250 other warnings in 30 days →Same productEarlier Accellion Kiteworks warnings57 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Accellion Kiteworks: Amber, patch this week. Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, in…

The flaws

  • CVE-2026-102101: Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data (CVSS 8.1 · EPSS 1%)
  • CVE-2026-102115: Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow (CVSS 9.8 · EPSS 1%)
  • CVE-2026-102106: Authentication bypass (CVSS 9.1 · EPSS 1%)
  • CVE-2026-102102: Server-side request forgery can lead to information disclosure (CVSS 9.1 · EPSS 1%)

The fix

Upgrade Accellion Kiteworks: 9.5.0 or later on your release line

Who is exposed: Accellion Kiteworks

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.1 high

References

Original description

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.

Last activity 30 Sep 2026. Patch Forecast updates every hour.