CVE-2026-102111

Published: Sep 30, 2026Modified: Oct 7, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.2 / Impact: 3.6

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative interface and audit log, allowing it to be silently rendered ineffective.

Affected (1)

Products: Accellion: Kiteworks

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Accellion Kiteworks	version < 9.5.0

Related CWEs

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (2)

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4r97-hch3-g2f9

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Broken Link

Timeline

No history available yet.