What’s Vulnerable › Vulnerabilities

CVE-2026-23514: Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-25 · updated 2026-06-17
• Weakness: CWE-282

Description

Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.

Affected products

• Kiteworks Email Protection Gateway: 9.2.0, 9.2.1

References

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gqr-cpr6-wvm5

Get alerted when CVE-2026-23514 or the next vulnerability affects your stack