CVE-2026-1021159.8CriticalCWE-640
CVE-2026-102115: Kiteworks Core Authentication Bypass in the Password Reset Workflow
Kiteworks · Core
Vendor fix available · Affected: Kiteworks Core · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
1.0%probability of exploitation in the next 30 days
64th percentile
050100
Higher than 64% of scored CVEs
9.8CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Kiteworks
- Published
- September 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 1 Oct.
- Kiteworks Fixes 78 Flaws Including Critical Admin Account TakeoverSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.