The vulnerability is a reflected XSS flaw in Kiteworks Secure Data Forms that existed before version 9.3.0. An external actor could provide a crafted link or form that, when a user interacts with it, causes arbitrary JavaScript to run in the user’s browser session. This could allow the attacker to exfiltrate session credentials, alter the displayed content, or perform actions on behalf of the user, thereby compromising both the confidentiality and integrity of data within the private data network.

The affected product is Kiteworks Secure Data Forms. Deployments running any version older than 9.3.0 are impacted; upgrading to version 9.3.0 or later eliminates the flaw.

The CVSS score of 8.2 signals a high severity risk. No EPSS value is available, but reflected XSS remains a common and effective attack vector. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale exploitation has been reported yet; however, the exploit requires user interaction, implying that the risk remains for users who may click malicious links or submit tampered forms. The likely attack vector is an attacker‑controlled URL or form presented to a user of the affected deployment.