What’s Vulnerable › Vulnerabilities
CVE-2026-28269: Kiteworks Core has an OS Command Injection
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-26 · updated 2026-06-17
- Weakness: CWE-78
Description
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
Affected products
- Kiteworks Email Protection Gateway: before 9.2.0 — fixed in 9.2.0
How to fix
Upgrade to a fixed version: Kiteworks Email Protection Gateway 9.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-28269 or the next vulnerability affects your stack