CVE-2026-102113

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could influence, allowing the attacker to cause a root-owned operation to run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.

• CWE-59
• CWE-269

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gwj7-wxrr-28v5
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Published

Sep 30, 2026

Last Modified

Oct 1, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102108An authenticated administrator of Kiteworks Email Protection…7.2
• CVE-2026-102109A SQL injection vulnerability existed in Kiteworks Secure Da…7.1
• CVE-2026-10211A vulnerability was determined in AstrBotDevs AstrBot 4.23.6…6.3
• CVE-2026-102110An endpoint used during initial appliance setup did not requ…5.9
• CVE-2026-102111Kiteworks did not enforce the maximum permitted value for a …4.9
• CVE-2026-102112A privilege escalation vulnerability in Kiteworks could allo…7.8
• CVE-2026-102114A command injection vulnerability in Kiteworks could allow a…7.2
• CVE-2026-102115Kiteworks Core did not correctly validate a parameter submit…9.8
• CVE-2026-102116-A weakness could have allowed an authenticated Kiteworks Em…7.2
• CVE-2026-102117On deployments where the remote-support capability is licens…7.2
• CVE-2026-102118A local privilege escalation vulnerability in Kiteworks coul…7.8
• CVE-2026-102119A path traversal weakness in an optional, non-default admini…7.2