Medium severity · published Mar 25, 2026
CVE-2026-23514
Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · kiteworks
>= 9.2.0, < 9.2.2 · source: vendor
KI
Kiteworks · Accellion
9.2.0; 9.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23514
Vendor Advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gqr-cpr6-wvm5
More from core
9.8
CVE-2026-102115
Kiteworks Core Authentication Bypass in the Password Reset Workflow
9.3
CVE-2026-102147
Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
8.8
CVE-2026-102120
Kiteworks Core OS Command Injection
8.8
CVE-2026-102125
Kiteworks Core Sandbox Escape
8.7
CVE-2026-102100
Kiteworks Core stored XSS