As cited
Copy frozen at (site build).
vulnerabilities
NCSC-2026-0408 Vulnerabilities fixed in Kiteworks
Kiteworks has patched multiple vulnerabilities across its product line, including remote code execution through inadequate validation in import and export functions, privilege escalation defects, server-side request forgery (SSRF), cross-site scripting (XSS), SQL injection in administrative functions, authentication bypasses, and resource exhaustion issues. Some flaws require authenticated administrator access, while others are exploitable without prior authentication, particularly during initial setup or through unsecured interfaces. Attackers could potentially chain unauthenticated vulnerabilities with privilege escalation to achieve administrator-level code execution.
Why it matters: Organizations using Kiteworks must patch immediately, as some vulnerabilities are exploitable without authentication and could lead to full system compromise through privilege escalation chains affecting file handling, database access, and cluster nodes.
- Source published
- First seen by Cybersecurity Tracker