Login Request a demo
High severity · published Sep 30, 2026
CVE-2026-102091
Kiteworks Secure Data Forms server-side request forgery
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Data Forms · Kiteworks
before 9.5.0 · source: vendor
KI
Kiteworks · Accellion
before 9.5.0 · source: NVD
Affected product
SD
Secure Data Forms
Kiteworks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102091
vendor-advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m8mj-m4fv-jmrh
third-party-advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
More from Secure Data Forms
8.8
CVE-2026-24782
Kiteworks Secure Data Forms has a SQL Injection vulnerability
8.6
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
8.2
CVE-2026-24752
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
8.2
CVE-2026-24751
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
7.2
CVE-2026-102150
Kiteworks Secure Data Forms Missing Authentication for Critical Function