CVE-2026-102147
CRITICAL
CVSS 9.3
Published: 2026-09-30
Modified: 2026-10-01
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.
Quick Facts
| CVE ID | CVE-2026-102147 |
| CVSS Score | 9.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| Published | 2026-09-30 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |