Medium severity · published Mar 25, 2026
CVE-2026-24750
Kiteworks Secure Data Forms vulnerable to Cross-site Scripting
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Data Forms · kiteworks
< 9.2.1 · source: vendor
KI
Kiteworks · Accellion
before 9.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24750
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24750
Vendor Advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rfwm-2hq6-h84g
More from Secure Data Forms
8.8
CVE-2026-24782
Kiteworks Secure Data Forms has a SQL Injection vulnerability
8.6
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
8.2
CVE-2026-24752
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
8.2
CVE-2026-24751
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
7.5
CVE-2026-102091
Kiteworks Secure Data Forms server-side request forgery