CVE-2026-23635: Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-25 · updated 2026-06-17
Weakness: CWE-523

Description

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Affected products

Kiteworks Email Protection Gateway: before 9.2.1 — fixed in 9.2.1

How to fix

Upgrade to a fixed version: Kiteworks Email Protection Gateway 9.2.1. Check the vendor advisory for mitigations.

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9hw2-6qp4-3v8f

Get alerted when CVE-2026-23635 or the next vulnerability affects your stack