Vulnerability Intelligence Report
Kiteworks Core Authentication Bypass in the Password Reset Workflow
CVE-2026-102115
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.53%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-640 ↗CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Kiteworks | Core | 0 < 9.5.0 (affected), 9.5.0 (unaffected) |
Threat Intelligence Signals
EPSS Score
0.528%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · CERT · USA |
| Reserved | 2026-09-28T17:39:13 |
| Published | 2026-09-30T20:19:55 |
| Patch Date | 2026-09-30 |
| Last Updated | 2026-10-01T13:37:03 |
Community Chatter & Buzz