{"id":"CVE-2026-102145","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102145","generatedAt":"2026-10-28T01:52:28.906Z","title":"On its own this did not result in code execution.","description":"An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.","published":"2026-09-30T21:17:03.000Z","lastModified":"2026-10-13T11:57:41.000Z","status":"Analyzed","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","cvss":{"version":"3.1","score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"},"cwe":["CWE-93"],"affected":["accellion/kiteworks"],"epss":{"score":0.00282,"percentile":0.20481,"date":"2026-10-26","history":[{"date":"2026-10-01","score":0.00387,"percentile":0.30307}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-30T21:17:03.000Z","detail":{"score":"6.6","severity":"MEDIUM","publishedAt":"2026-09-30T21:17:03.390Z"},"summary":"New CVE, medium severity (CVSS 6.6)."}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc","tags":["Vendor Advisory"],"source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":["Broken Link"],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102145","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}