CVE-2026-102093: Accellion Kiteworks

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

Affected products

• Accellion Kiteworks: before 9.5.0 (fixed in 9.5.0)

Published 2026-09-30. Last modified 2026-10-07.