CVE-2026-102115: Kiteworks Account Takeover
CVE-2026-102115 is a critical Kiteworks Core password-reset flaw that may enable unauthenticated account takeover, including administrative accounts. An attacker who knows a locally authenticated user’s email address may be able to reset the password without possessing the emailed reset link.
TL;DR - CVE-2026-102115 is a CVSS 9.8 improper-validation flaw in the Kiteworks Core password-reset workflow. - An unauthenticated attacker who knows a locally authenticated user’s email address may take over the account. - No verified public PoC or confirmed exploitation is known; contact Kiteworks urgently because affected and fixed versions are not yet confirmed.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-102115 |
| Product | Kiteworks Core |
| CVSS v3.1 score | 9.8 Critical |
| CVSS vector | Not present in the retrieved NVD record |
| Attack vector | Network |
| Authentication required | None, according to the vulnerability description |
| Privileges required | None |
| User interaction | Not required for the attacker; the victim may not need to interact |
| Impact | Potential account takeover, including administrative accounts |
| Patch status | No confirmed fixed version available in the retrieved sources |
CVE-2026-102115 affects the password-reset workflow in Kiteworks Core. The attacker does not need an existing Kiteworks session or account credentials. The stated prerequisites are knowledge of a target user’s email address and the target account’s use of a locally stored password.
The available research does not confirm an affected version range or a fixed release. Kiteworks release 9.5.1 appeared in a vendor search result dated September 25, 2026, but that material did not explicitly identify 9.5.1 as the remediation for this CVE. Administrators should not treat that release as a confirmed fix without direct vendor confirmation.
What Is This Vulnerability?
The vulnerability is an improper input-validation flaw in the Kiteworks Core password-reset process. The workflow apparently accepts a parameter that is not correctly validated, allowing an unauthenticated attacker to bypass the requirement to possess the emailed password-reset link. If successful, the attacker may set a new password and authenticate as the targeted user.
This is an account-takeover vulnerability rather than a simple password-reset denial of service. The attacker needs to know the victim’s email address, and the victim must use a locally stored password. Federated, externally managed, or otherwise non-local authentication may have different exposure characteristics, but the available record does not provide enough detail to declare those configurations safe.
The business impact depends on the compromised account. A standard user account could expose shared files, messages, or collaboration data. A privileged Kiteworks account could permit administrative changes, access to sensitive repositories, creation of additional accounts, or further compromise of connected systems. Organizations should prioritize local-password accounts with administrative or data-management privileges.
Who Is Affected?
The affected product is Kiteworks Core. The retrieved NVD information does not specify a vulnerable version range, and the accessible advisory material did not provide a parseable list of affected releases. It is not defensible to state that every Kiteworks Core release is vulnerable or to identify a precise lower and upper version boundary.
The practical exposure population is narrower than every account in a deployment. Defenders should first identify Kiteworks accounts that use locally stored passwords, especially administrator, tenant administrator, repository owner, and service-operated accounts. Internet-facing deployments deserve priority because the described attack requires no prior authentication and targets a web-accessible password-reset workflow.
The fixed version is also not confirmed. Version 9.5.1 was mentioned in a Kiteworks customer advisory search result, but the available evidence does not connect that release explicitly to CVE-2026-102115. Obtain the affected range and fixed release from Kiteworks Support or the authenticated vendor security advisory before marking systems remediated.
Analyst’s Take: Treat this as an exposure-validation problem first, not a version-comparison exercise. The fixed release is unconfirmed, while the described attack requires no prior authentication and may affect administrative accounts. Contact Kiteworks and review reset activity for locally authenticated privileged users before relying on 9.5.1 as remediation.
CVSS Score Breakdown
The assigned CVSS v3.1 base score is 9.8 Critical. The NVD record supplied for this assessment included the score but did not include the CVSS vector. The individual vector components therefore cannot be asserted as an official calculation from the source record.
The vulnerability description explains why the severity is high. The attack is performed remotely through a network-accessible workflow, requires no prior authentication, and may not require meaningful user interaction. The potential confidentiality, integrity, and availability consequences are substantial because successful exploitation can grant access to the victim account and may include administrative accounts.
The following operational interpretation is supported by the description, not a reconstructed official vector:
| CVSS consideration | Assessment |
|---|---|
| Network reachability | Consistent with a remotely accessible password-reset workflow |
| Authentication | No prior authentication required |
| Attacker privileges | None required |
| User interaction | No attacker-side authentication or reset-link possession required |
| Confidentiality | Potential access to data available to the compromised account |
| Integrity | Attacker may set a password and act as the victim |
| Availability | Potential loss of account control and administrative disruption |
Do not recalculate or publish a CVSS vector based on these interpretations. Use the recorded 9.8 score while treating the missing vector as an information gap that should be resolved through NVD or Kiteworks updates.
Exploitation Status
No confirmed in-the-wild exploitation was identified in the supplied NVD material, CISA lookup, or retrieved primary-source content. CVE-2026-102115 is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of the lookup. There is no CISA KEV due date or required-action deadline for this CVE.
No verified public proof-of-concept repository was identified in the supplied search results. A GitHub security-advisory reference exists for GHSA-q76w-qv9j-q639, but the presence of an advisory is not evidence that an exploit or working PoC is public. Defenders should distinguish between an advisory record and exploit code when triaging external reports.
The absence of KEV listing or a known PoC does not establish that exploitation has never occurred. It means only that confirmed evidence was not available in the sources reviewed. Given the low attack prerequisites and potential administrative impact, organizations should investigate relevant activity rather than wait for public exploitation evidence.
How to Detect It
Detection should focus on password-reset events, password changes, authentication anomalies, and administrative-account activity. The key investigative question is whether a password was changed without normal evidence that the emailed reset link was used. Exact event names and fields depend on the Kiteworks deployment and logging configuration, so teams should first export the product’s audit logs and map its password-reset terminology.
Search for clusters involving the same account: a reset request, a password change, and a successful login from an unfamiliar address or geography within a short interval. Also look for resets affecting administrator accounts, multiple accounts from one source IP, new sessions immediately after password changes, and resets that do not show expected email-delivery or reset-link-consumption events.
Technical Notes
The following generic shell query can identify likely reset and password-change records after exporting Kiteworks audit logs to a text file. Field names are intentionally not treated as Kiteworks-specific:
grep -Ein \
'password[ _-]?(reset|change)|reset[ _-]?request|forgot[ _-]?password|account[ _-]?recovery' \
kiteworks-audit.log
A SIEM detection can correlate reset-related events with authentication events. This pseudocode illustrates the logic and must be adapted to the actual parser and event schema:
reset_events
| where action matches "(?i)password.*reset|password.*change|account.*recovery"
| join kind=inner (
authentication_events
| where outcome == "success"
) on user_id
| where auth_time between (reset_time .. reset_time + 30m)
| summarize
reset_count = count(),
source_ips = make_set(source_ip),
countries = make_set(geo_country)
by user_id, bin(reset_time, 30m)
| where reset_count >= 1
For web-server telemetry, search the reverse-proxy access logs for password-reset endpoint requests followed by a successful login for the same account. Because the exact Kiteworks URI is not confirmed, avoid hard-coding an unverified path. Instead, identify the endpoint from observed normal traffic or vendor documentation, then alert on repeated requests, unusual query parameters, and requests from hosting-provider or anonymization-network addresses.
Mitigation and Patching
The correct remediation version is currently unknown. Kiteworks administrators should contact Kiteworks Support or consult the authenticated vendor advisory for CVE-2026-102115, obtain the exact affected range and fixed release, and follow the vendor-supported upgrade procedure. Do not assume that Kiteworks Core 9.5.1 fixes this issue solely because that version appeared in a separate customer advisory.
Until the fixed version is confirmed and deployed, prioritize internet-facing systems and privileged accounts. Require MFA for Kiteworks accounts where the product and identity architecture support it. Review locally stored-password accounts, disable or remove unnecessary administrative accounts, rotate credentials for potentially exposed users, and invalidate active sessions or tokens after password rotation where supported.
Organizations should also review established Linux patch management best practices when coordinating the vendor update and documenting remediation evidence. For remote administrative access, use only approved secure-access tools; teams comparing consumer VPN options may also review Check NordVPN pricing → as part of their broader access-control evaluation.
Restricting access to the administrative interface is a useful compensating control, but it may not protect a public user-facing password-reset endpoint. If operationally feasible, place administrative access behind a VPN or approved management network while preserving only the minimum external service exposure required for business operations. Coordinate any password-reset restriction with the identity and support teams to avoid locking out legitimate users.
Technical Notes
Because the fixed version and Kiteworks-specific upgrade command are not confirmed, do not execute an invented product command. After Kiteworks supplies the supported target release, record the exact vendor procedure in the change ticket and verify the installed version afterward. A generic change-control placeholder can make the dependency explicit:
# Replace the placeholder only with the release and command supplied by Kiteworks.
# Do not run this literal command.
kiteworks-upgrade --target <KITEWORKS_CONFIRMED_FIXED_VERSION>
A concrete temporary network control can restrict HTTPS access to a management host or approved administration subnet. The following UFW example is appropriate only when the host is managed locally, the interface should not be publicly reachable, and the administrator has verified that the rule will not disrupt required user traffic:
sudo ufw allow from 203.0.113.0/24 to any port 443 proto tcp
sudo ufw deny 443/tcp
sudo ufw status numbered
The example network is documentation-only and must be replaced with the organization’s real management range. For deployments behind a load balancer, firewall, reverse proxy, or appliance, apply the equivalent access policy at the control point that actually receives external traffic.
After remediation, rotate passwords for accounts that show suspicious reset activity, revoke active sessions where supported, and confirm that password-reset requests require the emailed link. Preserve relevant audit logs before changing credentials so investigators can correlate the original reset, password change, login, and subsequent administrative actions.
References
- NVD reference: GitHub Security Advisory GHSA-q76w-qv9j-q639
- CISA CSAF reference listed by NVD
This reference returned HTTP 404 during retrieval and could not be used to verify versions or remediation. - Kiteworks precautionary shutdown advisory
The available search result mentioned release 9.5.1 but did not establish it as the fixed version for CVE-2026-102115. - NVD record for CVE-2026-102115, published September 30, 2026.
- CISA Known Exploited Vulnerabilities catalog lookup for CVE-2026-102115: not listed at the time of review.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.