CVE-2026-102125

Kiteworks Core Sandbox Escape

Published Sep 30, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.

Analysis

Technical impact

Code executing inside the Kiteworks Core sandbox can escape confinement and act with the privileges of the service account that runs the application. This flaw allows a malicious actor already able to run code in the sandbox to read or modify application data and configuration, or to disrupt the service. The vulnerability is a sandbox escape (CWE-653) coupled with privilege escalation (CWE-668). The CVSS score of 8.8 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in CISA KEV.

Affected Systems

Kiteworks Core is affected, but no specific version information is listed in the advisory.

Risk and Exploitability

With a high CVSS score and the lack of an exploitation probability metric, the risk remains significant. Attackers would first need to supply malicious content that triggers code execution within the sandbox; from there they could escape to the service account. The likelihood of exploitation is uncertain due to missing EPSS data, but the potential impact includes unauthorized data access, configuration tampering, and service disruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Kiteworks

Core

unknown

Version	Status	Constraints
`0`	affected	< 9.5.0
`9.5.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Kiteworks

Core

Version	Status	Scheme	Platform
`[0,9.5.0)`	affected	semver	—
`9.5.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check for and apply the latest Kiteworks Core patch that fixes the sandbox confinement issue.
If no patch is available, disable the document conversion service to prevent code from running in the sandbox.
Implement network segmentation so the service account has limited reach to critical system components.

Generated by OpenCVE AI on September 30, 2026 at 21:59 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.392% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

History

Oct 8, 2026 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Accellion Accellion kiteworks
CPEs		cpe:2.3:a:accellion:kiteworks::::::::
Vendors & Products		Accellion Accellion kiteworks

Oct 1, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 1, 2026 11:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kiteworks Kiteworks core
Vendors & Products		Kiteworks Kiteworks core

Sep 30, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
Title		Kiteworks Core Sandbox Escape
Weaknesses		CWE-653 CWE-668
References		https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258 https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`