CVE-2026-102147: accellion kiteworks

CVSS 9.3 (critical) · published 2026-09-30

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.

Affected products (NVD): accellion kiteworks

Fixed in (NVD): 9.5.1

Weakness: CWE-79

Source: NVD CVE-2026-102147

References

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.