PT-2026-103534

CVE-2026-102096

Published

2026-09-30

Updated

2026-10-01

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0

Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the execution of arbitrary operating-system commands on the affected appliance, potentially with elevated privileges.

Recommendations Update Kiteworks Core to version 9.5.0 or later.

Exploitability

Fix

Impacts

Researchers

Icare

Supr4S

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers