High severity · published Jun 1, 2026
CVE-2026-24782
Kiteworks Secure Data Forms has a SQL Injection vulnerability
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Data Forms · kiteworks
< 9.3.0 · source: vendor
KI
Kiteworks · Accellion
before 9.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24782
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24782
Vendor Advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c
More from Secure Data Forms
8.6
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
8.2
CVE-2026-24752
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
8.2
CVE-2026-24751
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
7.5
CVE-2026-102091
Kiteworks Secure Data Forms server-side request forgery
7.2
CVE-2026-102150
Kiteworks Secure Data Forms Missing Authentication for Critical Function