CVE-2026-102115: accellion kiteworks

CVSS 9.8 (critical) · published 2026-09-30

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

Affected products (NVD): accellion kiteworks

Fixed in (NVD): 9.5.0

Weakness: CWE-640

Source: NVD CVE-2026-102115

References

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.