{"id":"CVE-2026-102147","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102147","generatedAt":"2026-10-28T03:58:43.643Z","title":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page.","description":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.","published":"2026-09-30T21:17:04.000Z","lastModified":"2026-10-07T15:02:06.000Z","status":"Analyzed","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","cvss":{"version":"3.1","score":9.3,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"},"cwe":["CWE-79"],"affected":["accellion/kiteworks"],"epss":{"score":0.00462,"percentile":0.39836,"date":"2026-10-27","history":[{"date":"2026-10-01","score":0.00435,"percentile":0.35429}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-30T21:17:04.000Z","detail":{"score":"9.3","severity":"CRITICAL","publishedAt":"2026-09-30T21:17:03.633Z"},"summary":"New CVE, critical severity (CVSS 9.3)."}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","tags":["Vendor Advisory"],"source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":["Broken Link"],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102147","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}