CVE-2026-24751

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Published Jun 1, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Analysis

Technical impact

A reflected XSS flaw exists in Kiteworks Secure Data Forms versions before 9.3.0, allowing an attacker to persuade a user to execute arbitrary JavaScript when a crafted URL or form is accessed. This type of attack can lead to hijacking of the victim’s session, theft of sensitive information, or further command execution within the application context.

Affected Systems

The vulnerability affects the Kiteworks Secure Data Forms component of the Kiteworks private data network. Systems running any version earlier than 9.3.0 are potentially exposed.

Risk and Exploitability

The CVSS score is 8.2, indicating a high‑severity issue. No EPSS value is provided and the vulnerability is not listed in the CISA KEV catalog, suggesting moderate awareness among exploiters. The likely attack vector is reflected XSS, which requires the victim to interact with a maliciously crafted link or form, making the attack user‑dependent but easy to execute once a careless user clicks the payload.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

kiteworks

Secure Data Forms

affected

Version	Status	Constraints
`< 9.3.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Kiteworks

Secure Data Forms

Version	Status	Scheme	Platform
`[0,9.3.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Kiteworks to version 9.3.0 or later to receive the vendor‑supplied patch.
Conduct sanity tests against your existing forms using standard XSS payloads to confirm the patch removes the vulnerability.
Implement a content security policy or a web application firewall rule that blocks inline script execution and restricts script sources to trusted domains.

Generated by OpenCVE AI on June 1, 2026 at 21:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.289% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947

History

Jun 3, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Accellion Accellion kiteworks
CPEs		cpe:2.3:a:accellion:kiteworks::::::::
Vendors & Products		Accellion Accellion kiteworks

Jun 2, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kiteworks Kiteworks secure Data Forms
Vendors & Products		Kiteworks Kiteworks secure Data Forms

Jun 1, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Title		Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
Weaknesses		CWE-79
References		https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'}`