CVE-2026-102132: Accellion Kiteworks

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.

Affected products

• Accellion Kiteworks: before 9.5.1 (fixed in 9.5.1)

Published 2026-09-30. Last modified 2026-10-07.