CVE-2026-102125GHSA-58j2-hj9r-c258
Kiteworks Core Sandbox Escape
Kiteworks Core
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 9.5.0CoreCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.
Text from CVE List
Affected versions 2
- Coreaffected: all versions before 9.5.0CVE List
- Coreunaffected: 9.5.0CVE List