CVE-2026-102150GHSA-vwvw-rp3m-rm37
Kiteworks Secure Data Forms Missing Authentication for Critical Function
Kiteworks Secure Data Forms
CVSS
7.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 9.5.1Secure Data FormsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.
Text from CVE List
Affected versions 2
- Secure Data Formsaffected: 9.3.0 before 9.5.1CVE List
- Secure Data Formsunaffected: 9.5.1CVE List