CVE-2026-102145

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc	Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

History

13 Oct 2026, 11:57

Type	Values Removed	Values Added
References	~~() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc -~~	() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc - Vendor Advisory
References	~~() https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json -~~	() https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json - Broken Link
First Time		Accellion Accellion kiteworks
CPE		cpe:2.3:a:accellion:kiteworks::::::::

30 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 21:17

Updated : 2026-10-13 11:57

NVD link : CVE-2026-102145

Mitre link : CVE-2026-102145

CVE.ORG link : CVE-2026-102145

JSON object : View

Products Affected

accellion

kiteworks

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

{"id": "CVE-2026-102145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102145", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T13:25:32.312235Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "affectedData": [{"vendor": "Kiteworks", "product": "Core", "versions": [{"status": "affected", "version": "0", "lessThan": "9.5.1", "versionType": "custom"}, {"status": "unaffected", "version": "9.5.1"}], "defaultStatus": "unknown"}]}], "published": "2026-09-30T21:17:03.390", "references": [{"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc", "tags": ["Vendor Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json", "tags": ["Broken Link"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution."}], "lastModified": "2026-10-13T11:57:40.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3DAD823-F1FD-402B-86A5-C69DD8261D4B", "versionEndExcluding": "9.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}