The vulnerability allows a malicious administrator to bypass Server‑Side Request Forgery protections via DNS rebinding within Kiteworks Core’s configuration functionality. This bypass grants access to internal services that should be unreachable from the public network, potentially permitting reading, modification, or tampering of internal data and applications and compromising confidentiality and integrity at the system level. The weakness is an Input Validation flaw (CWE-350) and an SSRF vulnerability (CWE-918).

All versions of Kiteworks Core supplied by Accellion, specifically every release before 9.2.0, are vulnerable. No other vendor or product is listed.

The CVSS score of 6.5 indicates moderate severity, while the EPSS of less than 1 % suggests a very low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated administrator who can submit configuration changes that trigger the DNS rebinding attack. Successful exploitation requires administrative privileges and the ability to influence outbound requests from the application. The overall risk is mitigated by the low probability of attack, and it is inferred from the description that the vulnerability does not provide immediate remote code execution capability.