{"schema_version":"2","view":"grouped","data":[{"id":42500,"cve_ids":["CVE-2026-58390"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58390","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-58390","aliases":["CVE-2026-58390"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-20T02:44:08.318Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf","https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868","https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58390","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T02:43:46.164395Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:44:08.318Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:21:09.883Z"}}},"related_cves":[{"value":"CVE-2026-58390","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5c2ef05b-35a7-4862-ade8-4337774eedc2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58390","advisory_id":"5c2ef05b-35a7-4862-ade8-4337774eedc2","event_types":["advisory"],"published_at":"2026-10-25T11:39:10.266292+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:21:09.883+00:00","detail_url":"/advisories/advisory%3A5c2ef05b-35a7-4862-ade8-4337774eedc2","group":{"id":"advisory:5c2ef05b-35a7-4862-ade8-4337774eedc2","revision":1,"primary_event_id":42108,"change":"published","superseded_by":[],"changed":{"id":42108,"cve_ids":["CVE-2026-58390"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58390","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-58390","aliases":["CVE-2026-58390"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-20T02:44:08.318Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf","https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868","https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58390","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T02:43:46.164395Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:44:08.318Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:21:09.883Z"}}},"related_cves":[{"value":"CVE-2026-58390","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5c2ef05b-35a7-4862-ade8-4337774eedc2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58390","advisory_id":"5c2ef05b-35a7-4862-ade8-4337774eedc2","event_types":["advisory"],"published_at":"2026-10-25T11:39:10.266292+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:21:09.883+00:00","detail_url":"/events/42108"},"members":[{"id":42108,"cve_ids":["CVE-2026-58390"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58390","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-58390","aliases":["CVE-2026-58390"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-20T02:44:08.318Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf","https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868","https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58390","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T02:43:46.164395Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:44:08.318Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:21:09.883Z"}}},"related_cves":[{"value":"CVE-2026-58390","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5c2ef05b-35a7-4862-ade8-4337774eedc2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58390","advisory_id":"5c2ef05b-35a7-4862-ade8-4337774eedc2","event_types":["advisory"],"published_at":"2026-10-25T11:39:10.266292+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:21:09.883+00:00","detail_url":"/events/42108"}]}},{"id":42490,"cve_ids":["CVE-2026-58391"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58391","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58391","aliases":["CVE-2026-58391"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-20T02:43:10.326Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h","https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4","https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58391","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T02:42:27.132294Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:43:10.326Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:12:08.334Z"}}},"related_cves":[{"value":"CVE-2026-58391","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8348cfe5-adaa-4b49-9acc-013e35e24ad0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58391","advisory_id":"8348cfe5-adaa-4b49-9acc-013e35e24ad0","event_types":["advisory"],"published_at":"2026-10-25T11:39:04.508255+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:12:08.334+00:00","detail_url":"/advisories/advisory%3A8348cfe5-adaa-4b49-9acc-013e35e24ad0","group":{"id":"advisory:8348cfe5-adaa-4b49-9acc-013e35e24ad0","revision":1,"primary_event_id":42099,"change":"published","superseded_by":[],"changed":{"id":42099,"cve_ids":["CVE-2026-58391"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58391","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58391","aliases":["CVE-2026-58391"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-20T02:43:10.326Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h","https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4","https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58391","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T02:42:27.132294Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:43:10.326Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:12:08.334Z"}}},"related_cves":[{"value":"CVE-2026-58391","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8348cfe5-adaa-4b49-9acc-013e35e24ad0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58391","advisory_id":"8348cfe5-adaa-4b49-9acc-013e35e24ad0","event_types":["advisory"],"published_at":"2026-10-25T11:39:04.508255+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:12:08.334+00:00","detail_url":"/events/42099"},"members":[{"id":42099,"cve_ids":["CVE-2026-58391"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58391","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58391","aliases":["CVE-2026-58391"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-20T02:43:10.326Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h","https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4","https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58391","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T02:42:27.132294Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:43:10.326Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:12:08.334Z"}}},"related_cves":[{"value":"CVE-2026-58391","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8348cfe5-adaa-4b49-9acc-013e35e24ad0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58391","advisory_id":"8348cfe5-adaa-4b49-9acc-013e35e24ad0","event_types":["advisory"],"published_at":"2026-10-25T11:39:04.508255+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:12:08.334+00:00","detail_url":"/events/42099"}]}},{"id":33107,"cve_ids":["CVE-2026-63442"],"payload":{"kind":"advisory","title":"OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-63442","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63442","aliases":["CVE-2026-63442"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-16T17:13:35.384Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv","https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4","https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63442","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T20:24:38.956809Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:13:35.384Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:22:16.011Z"}}},"related_cves":[{"value":"CVE-2026-63442","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ea2a725f-076f-4dba-b071-ab500e46ca12","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63442","advisory_id":"ea2a725f-076f-4dba-b071-ab500e46ca12","event_types":["advisory"],"published_at":"2026-10-25T08:56:04.933184+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:22:16.011+00:00","detail_url":"/advisories/advisory%3Aea2a725f-076f-4dba-b071-ab500e46ca12","group":{"id":"advisory:ea2a725f-076f-4dba-b071-ab500e46ca12","revision":1,"primary_event_id":32833,"change":"published","superseded_by":[],"changed":{"id":32833,"cve_ids":["CVE-2026-63442"],"payload":{"kind":"advisory","title":"OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-63442","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63442","aliases":["CVE-2026-63442"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-16T17:13:35.384Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv","https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4","https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63442","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T20:24:38.956809Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:13:35.384Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:22:16.011Z"}}},"related_cves":[{"value":"CVE-2026-63442","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ea2a725f-076f-4dba-b071-ab500e46ca12","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63442","advisory_id":"ea2a725f-076f-4dba-b071-ab500e46ca12","event_types":["advisory"],"published_at":"2026-10-25T08:56:04.933184+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:22:16.011+00:00","detail_url":"/events/32833"},"members":[{"id":32833,"cve_ids":["CVE-2026-63442"],"payload":{"kind":"advisory","title":"OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-63442","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63442","aliases":["CVE-2026-63442"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-16T17:13:35.384Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv","https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4","https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63442","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T20:24:38.956809Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:13:35.384Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:22:16.011Z"}}},"related_cves":[{"value":"CVE-2026-63442","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ea2a725f-076f-4dba-b071-ab500e46ca12","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63442","advisory_id":"ea2a725f-076f-4dba-b071-ab500e46ca12","event_types":["advisory"],"published_at":"2026-10-25T08:56:04.933184+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:22:16.011+00:00","detail_url":"/events/32833"}]}},{"id":33099,"cve_ids":["CVE-2026-53582"],"payload":{"kind":"advisory","title":"OPNsense: XPATH Injection can disclose any secret in config.xml","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.","evidence":"cve:CVE-2026-53582","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53582","aliases":["CVE-2026-53582"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.10"}]}],"modified":"2026-10-16T17:13:42.903Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r","https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45","https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2026/Jul/18"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-15T15:12:04.797Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53582","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T20:24:37.654161Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:13:42.903Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:08:46.374Z"}}},"related_cves":[{"value":"CVE-2026-53582","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1b0eec45-56af-4db0-a95a-f764fdcd8892","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53582","advisory_id":"1b0eec45-56af-4db0-a95a-f764fdcd8892","event_types":["advisory"],"published_at":"2026-10-25T08:55:59.805668+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:08:46.374+00:00","detail_url":"/advisories/advisory%3A1b0eec45-56af-4db0-a95a-f764fdcd8892","group":{"id":"advisory:1b0eec45-56af-4db0-a95a-f764fdcd8892","revision":1,"primary_event_id":32825,"change":"published","superseded_by":[],"changed":{"id":32825,"cve_ids":["CVE-2026-53582"],"payload":{"kind":"advisory","title":"OPNsense: XPATH Injection can disclose any secret in config.xml","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.","evidence":"cve:CVE-2026-53582","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53582","aliases":["CVE-2026-53582"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.10"}]}],"modified":"2026-10-16T17:13:42.903Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r","https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45","https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2026/Jul/18"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-15T15:12:04.797Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53582","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T20:24:37.654161Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:13:42.903Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:08:46.374Z"}}},"related_cves":[{"value":"CVE-2026-53582","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1b0eec45-56af-4db0-a95a-f764fdcd8892","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53582","advisory_id":"1b0eec45-56af-4db0-a95a-f764fdcd8892","event_types":["advisory"],"published_at":"2026-10-25T08:55:59.805668+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:08:46.374+00:00","detail_url":"/events/32825"},"members":[{"id":32825,"cve_ids":["CVE-2026-53582"],"payload":{"kind":"advisory","title":"OPNsense: XPATH Injection can disclose any secret in config.xml","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.","evidence":"cve:CVE-2026-53582","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53582","aliases":["CVE-2026-53582"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.10"}]}],"modified":"2026-10-16T17:13:42.903Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r","https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45","https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2026/Jul/18"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-15T15:12:04.797Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53582","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T20:24:37.654161Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:13:42.903Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:08:46.374Z"}}},"related_cves":[{"value":"CVE-2026-53582","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1b0eec45-56af-4db0-a95a-f764fdcd8892","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53582","advisory_id":"1b0eec45-56af-4db0-a95a-f764fdcd8892","event_types":["advisory"],"published_at":"2026-10-25T08:55:59.805668+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:08:46.374+00:00","detail_url":"/events/32825"}]}},{"id":30309,"cve_ids":["CVE-2026-58395"],"payload":{"kind":"advisory","title":"OPNsense: XPath injection in MVC safe-delete","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58395","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58395","aliases":["CVE-2026-58395"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T18:41:38.423Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w","https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b","https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58395","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T18:37:26.648179Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:41:38.423Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:16:49.985Z"}}},"related_cves":[{"value":"CVE-2026-58395","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7a13bd44-3d0b-4415-b23f-4d9c37a642df","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58395","advisory_id":"7a13bd44-3d0b-4415-b23f-4d9c37a642df","event_types":["advisory"],"published_at":"2026-10-25T08:09:45.562639+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:16:49.985+00:00","detail_url":"/advisories/advisory%3A7a13bd44-3d0b-4415-b23f-4d9c37a642df","group":{"id":"advisory:7a13bd44-3d0b-4415-b23f-4d9c37a642df","revision":1,"primary_event_id":30064,"change":"published","superseded_by":[],"changed":{"id":30064,"cve_ids":["CVE-2026-58395"],"payload":{"kind":"advisory","title":"OPNsense: XPath injection in MVC safe-delete","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58395","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58395","aliases":["CVE-2026-58395"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T18:41:38.423Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w","https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b","https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58395","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T18:37:26.648179Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:41:38.423Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:16:49.985Z"}}},"related_cves":[{"value":"CVE-2026-58395","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7a13bd44-3d0b-4415-b23f-4d9c37a642df","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58395","advisory_id":"7a13bd44-3d0b-4415-b23f-4d9c37a642df","event_types":["advisory"],"published_at":"2026-10-25T08:09:45.562639+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:16:49.985+00:00","detail_url":"/events/30064"},"members":[{"id":30064,"cve_ids":["CVE-2026-58395"],"payload":{"kind":"advisory","title":"OPNsense: XPath injection in MVC safe-delete","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58395","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58395","aliases":["CVE-2026-58395"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T18:41:38.423Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w","https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b","https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58395","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T18:37:26.648179Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:41:38.423Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:16:49.985Z"}}},"related_cves":[{"value":"CVE-2026-58395","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7a13bd44-3d0b-4415-b23f-4d9c37a642df","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58395","advisory_id":"7a13bd44-3d0b-4415-b23f-4d9c37a642df","event_types":["advisory"],"published_at":"2026-10-25T08:09:45.562639+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:16:49.985+00:00","detail_url":"/events/30064"}]}},{"id":30293,"cve_ids":["CVE-2026-58394"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Administration Settings via Certificate Description","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58394","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58394","aliases":["CVE-2026-58394"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T18:36:57.734Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb","https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58394","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T18:35:21.476267Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:36:57.734Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:20:15.232Z"}}},"related_cves":[{"value":"CVE-2026-58394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4b2f4b11-0012-4490-b4e4-c65cd1618d6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58394","advisory_id":"4b2f4b11-0012-4490-b4e4-c65cd1618d6d","event_types":["advisory"],"published_at":"2026-10-25T08:09:34.992957+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:20:15.232+00:00","detail_url":"/advisories/advisory%3A4b2f4b11-0012-4490-b4e4-c65cd1618d6d","group":{"id":"advisory:4b2f4b11-0012-4490-b4e4-c65cd1618d6d","revision":1,"primary_event_id":30048,"change":"published","superseded_by":[],"changed":{"id":30048,"cve_ids":["CVE-2026-58394"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Administration Settings via Certificate Description","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58394","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58394","aliases":["CVE-2026-58394"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T18:36:57.734Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb","https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58394","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T18:35:21.476267Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:36:57.734Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:20:15.232Z"}}},"related_cves":[{"value":"CVE-2026-58394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4b2f4b11-0012-4490-b4e4-c65cd1618d6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58394","advisory_id":"4b2f4b11-0012-4490-b4e4-c65cd1618d6d","event_types":["advisory"],"published_at":"2026-10-25T08:09:34.992957+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:20:15.232+00:00","detail_url":"/events/30048"},"members":[{"id":30048,"cve_ids":["CVE-2026-58394"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Administration Settings via Certificate Description","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58394","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58394","aliases":["CVE-2026-58394"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T18:36:57.734Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb","https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58394","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T18:35:21.476267Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T18:36:57.734Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:20:15.232Z"}}},"related_cves":[{"value":"CVE-2026-58394","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4b2f4b11-0012-4490-b4e4-c65cd1618d6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58394","advisory_id":"4b2f4b11-0012-4490-b4e4-c65cd1618d6d","event_types":["advisory"],"published_at":"2026-10-25T08:09:34.992957+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:20:15.232+00:00","detail_url":"/events/30048"}]}},{"id":30000,"cve_ids":["CVE-2026-58393"],"payload":{"kind":"advisory","title":"OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58393","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58393","aliases":["CVE-2026-58393"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T16:07:55.688Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98","https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58393","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T16:07:43.427308Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T16:07:55.688Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:15:45.924Z"}}},"related_cves":[{"value":"CVE-2026-58393","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1a644f36-a6bb-43fd-804e-e3718799c348","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58393","advisory_id":"1a644f36-a6bb-43fd-804e-e3718799c348","event_types":["advisory"],"published_at":"2026-10-25T08:04:18.041513+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:15:45.924+00:00","detail_url":"/advisories/advisory%3A1a644f36-a6bb-43fd-804e-e3718799c348","group":{"id":"advisory:1a644f36-a6bb-43fd-804e-e3718799c348","revision":1,"primary_event_id":29758,"change":"published","superseded_by":[],"changed":{"id":29758,"cve_ids":["CVE-2026-58393"],"payload":{"kind":"advisory","title":"OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58393","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58393","aliases":["CVE-2026-58393"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T16:07:55.688Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98","https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58393","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T16:07:43.427308Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T16:07:55.688Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:15:45.924Z"}}},"related_cves":[{"value":"CVE-2026-58393","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1a644f36-a6bb-43fd-804e-e3718799c348","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58393","advisory_id":"1a644f36-a6bb-43fd-804e-e3718799c348","event_types":["advisory"],"published_at":"2026-10-25T08:04:18.041513+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:15:45.924+00:00","detail_url":"/events/29758"},"members":[{"id":29758,"cve_ids":["CVE-2026-58393"],"payload":{"kind":"advisory","title":"OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58393","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58393","aliases":["CVE-2026-58393"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T16:07:55.688Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98","https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58393","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T16:07:43.427308Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T16:07:55.688Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:15:45.924Z"}}},"related_cves":[{"value":"CVE-2026-58393","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1a644f36-a6bb-43fd-804e-e3718799c348","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58393","advisory_id":"1a644f36-a6bb-43fd-804e-e3718799c348","event_types":["advisory"],"published_at":"2026-10-25T08:04:18.041513+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:15:45.924+00:00","detail_url":"/events/29758"}]}},{"id":29483,"cve_ids":["CVE-2026-58392"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Services: NTP GPS","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58392","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58392","aliases":["CVE-2026-58392"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:54:57.730Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5","https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c","https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58392","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:54:50.680359Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:54:57.730Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:18:32.003Z"}}},"related_cves":[{"value":"CVE-2026-58392","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:59122b6a-bf52-4844-8565-739c4e65a25c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58392","advisory_id":"59122b6a-bf52-4844-8565-739c4e65a25c","event_types":["advisory"],"published_at":"2026-10-25T07:55:57.801891+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:18:32.003+00:00","detail_url":"/advisories/advisory%3A59122b6a-bf52-4844-8565-739c4e65a25c","group":{"id":"advisory:59122b6a-bf52-4844-8565-739c4e65a25c","revision":1,"primary_event_id":29249,"change":"published","superseded_by":[],"changed":{"id":29249,"cve_ids":["CVE-2026-58392"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Services: NTP GPS","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58392","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58392","aliases":["CVE-2026-58392"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:54:57.730Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5","https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c","https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58392","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:54:50.680359Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:54:57.730Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:18:32.003Z"}}},"related_cves":[{"value":"CVE-2026-58392","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:59122b6a-bf52-4844-8565-739c4e65a25c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58392","advisory_id":"59122b6a-bf52-4844-8565-739c4e65a25c","event_types":["advisory"],"published_at":"2026-10-25T07:55:57.801891+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:18:32.003+00:00","detail_url":"/events/29249"},"members":[{"id":29249,"cve_ids":["CVE-2026-58392"],"payload":{"kind":"advisory","title":"OPNsense: Stored XSS in Services: NTP GPS","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-58392","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-58392","aliases":["CVE-2026-58392"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:54:57.730Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5","https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c","https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-58392","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:54:50.680359Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:54:57.730Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:18:32.003Z"}}},"related_cves":[{"value":"CVE-2026-58392","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:59122b6a-bf52-4844-8565-739c4e65a25c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-58392","advisory_id":"59122b6a-bf52-4844-8565-739c4e65a25c","event_types":["advisory"],"published_at":"2026-10-25T07:55:57.801891+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:18:32.003+00:00","detail_url":"/events/29249"}]}},{"id":29274,"cve_ids":["CVE-2026-71490"],"payload":{"kind":"advisory","title":"OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-71490","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71490","aliases":["CVE-2026-71490"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:45:03.645Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw","https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505","https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9","https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71490","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:44:35.198725Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:45:03.645Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:24:43.580Z"}}},"related_cves":[{"value":"CVE-2026-71490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b5a6aac8-545a-4b0f-b135-0d9b85c3f261","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71490","advisory_id":"b5a6aac8-545a-4b0f-b135-0d9b85c3f261","event_types":["advisory"],"published_at":"2026-10-25T07:52:04.073166+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:24:43.58+00:00","detail_url":"/advisories/advisory%3Ab5a6aac8-545a-4b0f-b135-0d9b85c3f261","group":{"id":"advisory:b5a6aac8-545a-4b0f-b135-0d9b85c3f261","revision":1,"primary_event_id":29043,"change":"published","superseded_by":[],"changed":{"id":29043,"cve_ids":["CVE-2026-71490"],"payload":{"kind":"advisory","title":"OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-71490","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71490","aliases":["CVE-2026-71490"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:45:03.645Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw","https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505","https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9","https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71490","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:44:35.198725Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:45:03.645Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:24:43.580Z"}}},"related_cves":[{"value":"CVE-2026-71490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b5a6aac8-545a-4b0f-b135-0d9b85c3f261","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71490","advisory_id":"b5a6aac8-545a-4b0f-b135-0d9b85c3f261","event_types":["advisory"],"published_at":"2026-10-25T07:52:04.073166+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:24:43.58+00:00","detail_url":"/events/29043"},"members":[{"id":29043,"cve_ids":["CVE-2026-71490"],"payload":{"kind":"advisory","title":"OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-71490","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71490","aliases":["CVE-2026-71490"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:45:03.645Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw","https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505","https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9","https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71490","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:44:35.198725Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:45:03.645Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:24:43.580Z"}}},"related_cves":[{"value":"CVE-2026-71490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b5a6aac8-545a-4b0f-b135-0d9b85c3f261","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71490","advisory_id":"b5a6aac8-545a-4b0f-b135-0d9b85c3f261","event_types":["advisory"],"published_at":"2026-10-25T07:52:04.073166+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:24:43.58+00:00","detail_url":"/events/29043"}]}},{"id":29271,"cve_ids":["CVE-2026-57155"],"payload":{"kind":"advisory","title":"OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-57155","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-57155","aliases":["CVE-2026-57155"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:45:48.529Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57155","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T15:45:26.496634Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:45:48.529Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:13:12.343Z"}}},"related_cves":[{"value":"CVE-2026-57155","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1661f200-dddb-468e-a22e-57ce6d750f3e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57155","advisory_id":"1661f200-dddb-468e-a22e-57ce6d750f3e","event_types":["advisory"],"published_at":"2026-10-25T07:52:02.035042+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:13:12.343+00:00","detail_url":"/advisories/advisory%3A1661f200-dddb-468e-a22e-57ce6d750f3e","group":{"id":"advisory:1661f200-dddb-468e-a22e-57ce6d750f3e","revision":1,"primary_event_id":29040,"change":"published","superseded_by":[],"changed":{"id":29040,"cve_ids":["CVE-2026-57155"],"payload":{"kind":"advisory","title":"OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-57155","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-57155","aliases":["CVE-2026-57155"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:45:48.529Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57155","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T15:45:26.496634Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:45:48.529Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:13:12.343Z"}}},"related_cves":[{"value":"CVE-2026-57155","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1661f200-dddb-468e-a22e-57ce6d750f3e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57155","advisory_id":"1661f200-dddb-468e-a22e-57ce6d750f3e","event_types":["advisory"],"published_at":"2026-10-25T07:52:02.035042+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:13:12.343+00:00","detail_url":"/events/29040"},"members":[{"id":29040,"cve_ids":["CVE-2026-57155"],"payload":{"kind":"advisory","title":"OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.","evidence":"cve:CVE-2026-57155","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-57155","aliases":["CVE-2026-57155"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"opnsense","product":"core","versions":[{"status":"affected","version":"< 26.1.11"}]}],"modified":"2026-10-15T15:45:48.529Z","provider":"cve","references":["https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","https://hackerask.com/posts/opnsense"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57155","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T15:45:26.496634Z"}}}],"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:45:48.529Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-15T15:13:12.343Z"}}},"related_cves":[{"value":"CVE-2026-57155","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1661f200-dddb-468e-a22e-57ce6d750f3e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57155","advisory_id":"1661f200-dddb-468e-a22e-57ce6d750f3e","event_types":["advisory"],"published_at":"2026-10-25T07:52:02.035042+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T15:13:12.343+00:00","detail_url":"/events/29040"}]}},{"id":17410,"cve_ids":["CVE-2026-108725"],"payload":{"kind":"advisory","title":"Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin","summary":"Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.","evidence":"cve:CVE-2026-108725","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108725","aliases":["CVE-2026-108725"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/cheshire-cat-ai/core","vendor":"cheshire-cat-ai","product":"core","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.0.23"}],"packageURL":"pkg:github/cheshire-cat-ai/core","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:18:28.253Z","provider":"cve","references":["https://hackmd.io/@haind03/cheshire-cat-uploads-stored-html-same-origin-xss","https://github.com/cheshire-cat-ai/core/blob/c22731e7009ac89835b1d7b1cabc5989d998ec3e/src/cat/scaffold/plugins/uploads/endpoints.py#L28-L96","https://github.com/cheshire-cat-ai/core","https://www.vulncheck.com/advisories/cheshire-cat-ai-core-through-2.0.23-stored-xss-via-uploads-plugin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108725","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:18:05.919586Z"}}}],"references":[{"url":"https://hackmd.io/@haind03/cheshire-cat-uploads-stored-html-same-origin-xss","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:18:28.253Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:34.601Z"}}},"related_cves":[{"value":"CVE-2026-108725","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:23537e36-2a5b-4b6d-98f5-f9f339bc9a39","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108725","advisory_id":"23537e36-2a5b-4b6d-98f5-f9f339bc9a39","event_types":["advisory"],"published_at":"2026-10-25T01:31:01.795715+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T12:19:34.601+00:00","detail_url":"/advisories/advisory%3A23537e36-2a5b-4b6d-98f5-f9f339bc9a39","group":{"id":"advisory:23537e36-2a5b-4b6d-98f5-f9f339bc9a39","revision":1,"primary_event_id":17295,"change":"published","superseded_by":[],"changed":{"id":17295,"cve_ids":["CVE-2026-108725"],"payload":{"kind":"advisory","title":"Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin","summary":"Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.","evidence":"cve:CVE-2026-108725","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108725","aliases":["CVE-2026-108725"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/cheshire-cat-ai/core","vendor":"cheshire-cat-ai","product":"core","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.0.23"}],"packageURL":"pkg:github/cheshire-cat-ai/core","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:18:28.253Z","provider":"cve","references":["https://hackmd.io/@haind03/cheshire-cat-uploads-stored-html-same-origin-xss","https://github.com/cheshire-cat-ai/core/blob/c22731e7009ac89835b1d7b1cabc5989d998ec3e/src/cat/scaffold/plugins/uploads/endpoints.py#L28-L96","https://github.com/cheshire-cat-ai/core","https://www.vulncheck.com/advisories/cheshire-cat-ai-core-through-2.0.23-stored-xss-via-uploads-plugin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108725","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:18:05.919586Z"}}}],"references":[{"url":"https://hackmd.io/@haind03/cheshire-cat-uploads-stored-html-same-origin-xss","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:18:28.253Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:34.601Z"}}},"related_cves":[{"value":"CVE-2026-108725","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:23537e36-2a5b-4b6d-98f5-f9f339bc9a39","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108725","advisory_id":"23537e36-2a5b-4b6d-98f5-f9f339bc9a39","event_types":["advisory"],"published_at":"2026-10-25T01:31:01.795715+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T12:19:34.601+00:00","detail_url":"/events/17295"},"members":[{"id":17295,"cve_ids":["CVE-2026-108725"],"payload":{"kind":"advisory","title":"Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin","summary":"Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.","evidence":"cve:CVE-2026-108725","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108725","aliases":["CVE-2026-108725"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/cheshire-cat-ai/core","vendor":"cheshire-cat-ai","product":"core","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"2.0.23"}],"packageURL":"pkg:github/cheshire-cat-ai/core","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:18:28.253Z","provider":"cve","references":["https://hackmd.io/@haind03/cheshire-cat-uploads-stored-html-same-origin-xss","https://github.com/cheshire-cat-ai/core/blob/c22731e7009ac89835b1d7b1cabc5989d998ec3e/src/cat/scaffold/plugins/uploads/endpoints.py#L28-L96","https://github.com/cheshire-cat-ai/core","https://www.vulncheck.com/advisories/cheshire-cat-ai-core-through-2.0.23-stored-xss-via-uploads-plugin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108725","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:18:05.919586Z"}}}],"references":[{"url":"https://hackmd.io/@haind03/cheshire-cat-uploads-stored-html-same-origin-xss","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:18:28.253Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:34.601Z"}}},"related_cves":[{"value":"CVE-2026-108725","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:23537e36-2a5b-4b6d-98f5-f9f339bc9a39","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108725","advisory_id":"23537e36-2a5b-4b6d-98f5-f9f339bc9a39","event_types":["advisory"],"published_at":"2026-10-25T01:31:01.795715+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T12:19:34.601+00:00","detail_url":"/events/17295"}]}},{"id":11994,"cve_ids":["CVE-2026-102141"],"payload":{"kind":"advisory","title":"Kiteworks Core Privilege Escalation through External Control of File Name or Path","summary":"Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.","evidence":"cve:CVE-2026-102141","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102141","aliases":["CVE-2026-102141"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-07T15:52:15.930Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m39v-w8fv-gf3m","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102141","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T15:09:49.121447Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T15:52:15.930Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:55.599Z"}}},"related_cves":[{"value":"CVE-2026-102141","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102141","advisory_id":"e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","event_types":["advisory"],"published_at":"2026-10-24T23:59:14.755289+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:55.599+00:00","detail_url":"/advisories/advisory%3Ae8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","group":{"id":"advisory:e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","revision":1,"primary_event_id":11939,"change":"published","superseded_by":[],"changed":{"id":11939,"cve_ids":["CVE-2026-102141"],"payload":{"kind":"advisory","title":"Kiteworks Core Privilege Escalation through External Control of File Name or Path","summary":"Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.","evidence":"cve:CVE-2026-102141","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102141","aliases":["CVE-2026-102141"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-07T15:52:15.930Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m39v-w8fv-gf3m","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102141","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T15:09:49.121447Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T15:52:15.930Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:55.599Z"}}},"related_cves":[{"value":"CVE-2026-102141","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102141","advisory_id":"e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","event_types":["advisory"],"published_at":"2026-10-24T23:59:14.755289+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:55.599+00:00","detail_url":"/events/11939"},"members":[{"id":11939,"cve_ids":["CVE-2026-102141"],"payload":{"kind":"advisory","title":"Kiteworks Core Privilege Escalation through External Control of File Name or Path","summary":"Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node.","evidence":"cve:CVE-2026-102141","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102141","aliases":["CVE-2026-102141"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-07T15:52:15.930Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m39v-w8fv-gf3m","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102141","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T15:09:49.121447Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T15:52:15.930Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:55.599Z"}}},"related_cves":[{"value":"CVE-2026-102141","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102141","advisory_id":"e8a3b6bd-cfe2-41cb-874e-7b9cd7afa9c0","event_types":["advisory"],"published_at":"2026-10-24T23:59:14.755289+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:55.599+00:00","detail_url":"/events/11939"}]}},{"id":11992,"cve_ids":["CVE-2026-102100"],"payload":{"kind":"advisory","title":"Kiteworks Core stored XSS","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.","evidence":"cve:CVE-2026-102100","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102100","aliases":["CVE-2026-102100"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-07T15:52:16.061Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vr65-9jwc-jgjx","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102100","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T15:09:13.199231Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T15:52:16.061Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:05.276Z"}}},"related_cves":[{"value":"CVE-2026-102100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d46ec167-b643-4f53-8c6b-075a348f615f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102100","advisory_id":"d46ec167-b643-4f53-8c6b-075a348f615f","event_types":["advisory"],"published_at":"2026-10-24T23:59:13.293424+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:05.276+00:00","detail_url":"/advisories/advisory%3Ad46ec167-b643-4f53-8c6b-075a348f615f","group":{"id":"advisory:d46ec167-b643-4f53-8c6b-075a348f615f","revision":1,"primary_event_id":11937,"change":"published","superseded_by":[],"changed":{"id":11937,"cve_ids":["CVE-2026-102100"],"payload":{"kind":"advisory","title":"Kiteworks Core stored XSS","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.","evidence":"cve:CVE-2026-102100","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102100","aliases":["CVE-2026-102100"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-07T15:52:16.061Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vr65-9jwc-jgjx","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102100","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T15:09:13.199231Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T15:52:16.061Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:05.276Z"}}},"related_cves":[{"value":"CVE-2026-102100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d46ec167-b643-4f53-8c6b-075a348f615f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102100","advisory_id":"d46ec167-b643-4f53-8c6b-075a348f615f","event_types":["advisory"],"published_at":"2026-10-24T23:59:13.293424+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:05.276+00:00","detail_url":"/events/11937"},"members":[{"id":11937,"cve_ids":["CVE-2026-102100"],"payload":{"kind":"advisory","title":"Kiteworks Core stored XSS","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.","evidence":"cve:CVE-2026-102100","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102100","aliases":["CVE-2026-102100"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-07T15:52:16.061Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vr65-9jwc-jgjx","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102100","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T15:09:13.199231Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T15:52:16.061Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:05.276Z"}}},"related_cves":[{"value":"CVE-2026-102100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d46ec167-b643-4f53-8c6b-075a348f615f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102100","advisory_id":"d46ec167-b643-4f53-8c6b-075a348f615f","event_types":["advisory"],"published_at":"2026-10-24T23:59:13.293424+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:05.276+00:00","detail_url":"/events/11937"}]}},{"id":7778,"cve_ids":["CVE-2018-7602"],"payload":{"kind":"advisory","title":"Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","evidence":"cve:CVE-2018-7602","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7602","aliases":["CVE-2018-7602"],"metrics":[],"affected":[{"vendor":"Drupal","product":"core","versions":[{"status":"affected","version":"unspecified","lessThan":"7.59","versionType":"custom"},{"status":"affected","version":"unspecified","lessThan":"8.5.3","versionType":"custom"},{"status":"affected","version":"unspecified","lessThan":"8.4.8","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-01T20:28:55.110Z","provider":"cve","references":["https://www.exploit-db.com/exploits/44557/","https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","https://www.exploit-db.com/exploits/44542/","https://www.debian.org/security/2018/dsa-4180","https://www.drupal.org/sa-core-2018-004"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.exploit-db.com/exploits/44557/","name":"44557","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040754","name":"1040754","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","name":"[debian-lts-announce] 20180426 [SECURITY] [DLA 1365-1] drupal7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/44542/","name":"44542","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4180","name":"DSA-4180","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.drupal.org/sa-core-2018-004","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103985","name":"103985","tags":["vdb-entry","x_refsource_BID","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T06:31:04.989Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2018-7602","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-13T03:55:34.450184Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2022-04-13","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T20:28:55.110Z"}}],"cna":{"orgId":"2c85b837-eb8b-40ed-9d74-228c62987387","shortName":"drupal","dateUpdated":"2025-12-17T00:06:27.768Z"}}},"related_cves":[{"value":"CVE-2018-7602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:768dd95e-2c8f-4f92-81f7-08e0b1106a2d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[{"cve":"CVE-2018-7602","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7602","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-7602","advisory_id":"768dd95e-2c8f-4f92-81f7-08e0b1106a2d","event_types":["advisory"],"published_at":"2026-10-24T22:50:00.429093+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-07-19T17:00:00+00:00","detail_url":"/advisories/advisory%3A768dd95e-2c8f-4f92-81f7-08e0b1106a2d","group":{"id":"advisory:768dd95e-2c8f-4f92-81f7-08e0b1106a2d","revision":1,"primary_event_id":7776,"change":"published","superseded_by":[],"changed":{"id":7776,"cve_ids":["CVE-2018-7602"],"payload":{"kind":"advisory","title":"Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","evidence":"cve:CVE-2018-7602","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7602","aliases":["CVE-2018-7602"],"metrics":[],"affected":[{"vendor":"Drupal","product":"core","versions":[{"status":"affected","version":"unspecified","lessThan":"7.59","versionType":"custom"},{"status":"affected","version":"unspecified","lessThan":"8.5.3","versionType":"custom"},{"status":"affected","version":"unspecified","lessThan":"8.4.8","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-01T20:28:55.110Z","provider":"cve","references":["https://www.exploit-db.com/exploits/44557/","https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","https://www.exploit-db.com/exploits/44542/","https://www.debian.org/security/2018/dsa-4180","https://www.drupal.org/sa-core-2018-004"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.exploit-db.com/exploits/44557/","name":"44557","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040754","name":"1040754","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","name":"[debian-lts-announce] 20180426 [SECURITY] [DLA 1365-1] drupal7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/44542/","name":"44542","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4180","name":"DSA-4180","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.drupal.org/sa-core-2018-004","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103985","name":"103985","tags":["vdb-entry","x_refsource_BID","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T06:31:04.989Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2018-7602","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-13T03:55:34.450184Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2022-04-13","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T20:28:55.110Z"}}],"cna":{"orgId":"2c85b837-eb8b-40ed-9d74-228c62987387","shortName":"drupal","dateUpdated":"2025-12-17T00:06:27.768Z"}}},"related_cves":[{"value":"CVE-2018-7602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:768dd95e-2c8f-4f92-81f7-08e0b1106a2d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[{"cve":"CVE-2018-7602","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7602","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-7602","advisory_id":"768dd95e-2c8f-4f92-81f7-08e0b1106a2d","event_types":["advisory"],"published_at":"2026-10-24T22:50:00.429093+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-07-19T17:00:00+00:00","detail_url":"/events/7776"},"members":[{"id":7776,"cve_ids":["CVE-2018-7602"],"payload":{"kind":"advisory","title":"Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","evidence":"cve:CVE-2018-7602","products":[{"name":{"value":"core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7602","aliases":["CVE-2018-7602"],"metrics":[],"affected":[{"vendor":"Drupal","product":"core","versions":[{"status":"affected","version":"unspecified","lessThan":"7.59","versionType":"custom"},{"status":"affected","version":"unspecified","lessThan":"8.5.3","versionType":"custom"},{"status":"affected","version":"unspecified","lessThan":"8.4.8","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-01T20:28:55.110Z","provider":"cve","references":["https://www.exploit-db.com/exploits/44557/","https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","https://www.exploit-db.com/exploits/44542/","https://www.debian.org/security/2018/dsa-4180","https://www.drupal.org/sa-core-2018-004"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.exploit-db.com/exploits/44557/","name":"44557","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040754","name":"1040754","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","name":"[debian-lts-announce] 20180426 [SECURITY] [DLA 1365-1] drupal7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/44542/","name":"44542","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4180","name":"DSA-4180","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.drupal.org/sa-core-2018-004","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103985","name":"103985","tags":["vdb-entry","x_refsource_BID","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T06:31:04.989Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2018-7602","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-13T03:55:34.450184Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2022-04-13","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T20:28:55.110Z"}}],"cna":{"orgId":"2c85b837-eb8b-40ed-9d74-228c62987387","shortName":"drupal","dateUpdated":"2025-12-17T00:06:27.768Z"}}},"related_cves":[{"value":"CVE-2018-7602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:768dd95e-2c8f-4f92-81f7-08e0b1106a2d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[{"cve":"CVE-2018-7602","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7602","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-7602","advisory_id":"768dd95e-2c8f-4f92-81f7-08e0b1106a2d","event_types":["advisory"],"published_at":"2026-10-24T22:50:00.429093+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-07-19T17:00:00+00:00","detail_url":"/events/7776"}]}},{"id":7620,"cve_ids":["CVE-2026-103922"],"payload":{"kind":"advisory","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","summary":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","evidence":"cve:CVE-2026-103922","products":[{"name":{"value":"capacitor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"android","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ios","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"core","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ionic-team/capacitor-swift-pm","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-103922","aliases":["CVE-2026-103922"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ionic-team","product":"capacitor","versions":[{"status":"affected","version":">= 6.0.0, < 6.2.2"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.5.0, < 8.5.1"}]},{"vendor":"@capacitor","product":"android","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"@capacitor","product":"ios","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"com.capacitorjs","product":"core","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"swift","product":"github.com/ionic-team/capacitor-swift-pm","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]}],"modified":"2026-10-01T18:01:54.381Z","provider":"cve","references":["https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103922","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T18:01:35.925716Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T18:01:54.381Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-01T17:27:05.758Z"}}},"related_cves":[{"value":"CVE-2026-103922","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103922","advisory_id":"cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","event_types":["advisory"],"published_at":"2026-10-24T22:47:39.867229+00:00","technologies":["android","capacitor","core","core-cve","github-com-ionic-team-capacitor-swift-pm","ios"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T17:27:05.758+00:00","detail_url":"/advisories/advisory%3Acd0e2062-1d59-49d2-9005-d5ab1ff3c21e","group":{"id":"advisory:cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","revision":1,"primary_event_id":7619,"change":"published","superseded_by":[],"changed":{"id":7619,"cve_ids":["CVE-2026-103922"],"payload":{"kind":"advisory","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","summary":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","evidence":"cve:CVE-2026-103922","products":[{"name":{"value":"capacitor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"android","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ios","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"core","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ionic-team/capacitor-swift-pm","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-103922","aliases":["CVE-2026-103922"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ionic-team","product":"capacitor","versions":[{"status":"affected","version":">= 6.0.0, < 6.2.2"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.5.0, < 8.5.1"}]},{"vendor":"@capacitor","product":"android","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"@capacitor","product":"ios","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"com.capacitorjs","product":"core","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"swift","product":"github.com/ionic-team/capacitor-swift-pm","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]}],"modified":"2026-10-01T18:01:54.381Z","provider":"cve","references":["https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103922","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T18:01:35.925716Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T18:01:54.381Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-01T17:27:05.758Z"}}},"related_cves":[{"value":"CVE-2026-103922","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103922","advisory_id":"cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","event_types":["advisory"],"published_at":"2026-10-24T22:47:39.867229+00:00","technologies":["android","capacitor","core","core-cve","github-com-ionic-team-capacitor-swift-pm","ios"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T17:27:05.758+00:00","detail_url":"/events/7619"},"members":[{"id":7619,"cve_ids":["CVE-2026-103922"],"payload":{"kind":"advisory","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","summary":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","evidence":"cve:CVE-2026-103922","products":[{"name":{"value":"capacitor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"android","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ios","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"core","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ionic-team/capacitor-swift-pm","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-103922","aliases":["CVE-2026-103922"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ionic-team","product":"capacitor","versions":[{"status":"affected","version":">= 6.0.0, < 6.2.2"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.5.0, < 8.5.1"}]},{"vendor":"@capacitor","product":"android","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"@capacitor","product":"ios","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"com.capacitorjs","product":"core","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]},{"vendor":"swift","product":"github.com/ionic-team/capacitor-swift-pm","versions":[{"status":"affected","version":">= 8.5.0, < 8.5.1"},{"status":"affected","version":">= 8.3.5, < 8.4.3"},{"status":"affected","version":">= 8.0.0, < 8.3.5"},{"status":"affected","version":">= 7.0.0, < 7.6.9"},{"status":"affected","version":">= 6.0.0, < 6.2.2"}]}],"modified":"2026-10-01T18:01:54.381Z","provider":"cve","references":["https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103922","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T18:01:35.925716Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T18:01:54.381Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-01T17:27:05.758Z"}}},"related_cves":[{"value":"CVE-2026-103922","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103922","advisory_id":"cd0e2062-1d59-49d2-9005-d5ab1ff3c21e","event_types":["advisory"],"published_at":"2026-10-24T22:47:39.867229+00:00","technologies":["android","capacitor","core","core-cve","github-com-ionic-team-capacitor-swift-pm","ios"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T17:27:05.758+00:00","detail_url":"/events/7619"}]}},{"id":5597,"cve_ids":["CVE-2026-102142"],"payload":{"kind":"advisory","title":"Kiteworks Core Remote Code Execution through Server-Side Template Injection","summary":"A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.","evidence":"cve:CVE-2026-102142","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102142","aliases":["CVE-2026-102142"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:05.497Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gmgg-7xhc-75f9","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102142","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:14:11.835510Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:05.497Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:30.182Z"}}},"related_cves":[{"value":"CVE-2026-102142","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:24c49ee1-feb2-48fb-84e1-9d1b265c8db0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102142","advisory_id":"24c49ee1-feb2-48fb-84e1-9d1b265c8db0","event_types":["advisory"],"published_at":"2026-10-24T22:11:03.758229+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:30.182+00:00","detail_url":"/advisories/advisory%3A24c49ee1-feb2-48fb-84e1-9d1b265c8db0","group":{"id":"advisory:24c49ee1-feb2-48fb-84e1-9d1b265c8db0","revision":1,"primary_event_id":5618,"change":"published","superseded_by":[],"changed":{"id":5618,"cve_ids":["CVE-2026-102142"],"payload":{"kind":"advisory","title":"Kiteworks Core Remote Code Execution through Server-Side Template Injection","summary":"A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.","evidence":"cve:CVE-2026-102142","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102142","aliases":["CVE-2026-102142"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:05.497Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gmgg-7xhc-75f9","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102142","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:14:11.835510Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:05.497Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:30.182Z"}}},"related_cves":[{"value":"CVE-2026-102142","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:24c49ee1-feb2-48fb-84e1-9d1b265c8db0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102142","advisory_id":"24c49ee1-feb2-48fb-84e1-9d1b265c8db0","event_types":["advisory"],"published_at":"2026-10-24T22:11:03.758229+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:30.182+00:00","detail_url":"/events/5618"},"members":[{"id":5618,"cve_ids":["CVE-2026-102142"],"payload":{"kind":"advisory","title":"Kiteworks Core Remote Code Execution through Server-Side Template Injection","summary":"A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.","evidence":"cve:CVE-2026-102142","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102142","aliases":["CVE-2026-102142"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:05.497Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gmgg-7xhc-75f9","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102142","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:14:11.835510Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:05.497Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:10:30.182Z"}}},"related_cves":[{"value":"CVE-2026-102142","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:24c49ee1-feb2-48fb-84e1-9d1b265c8db0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102142","advisory_id":"24c49ee1-feb2-48fb-84e1-9d1b265c8db0","event_types":["advisory"],"published_at":"2026-10-24T22:11:03.758229+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:10:30.182+00:00","detail_url":"/events/5618"}]}},{"id":5596,"cve_ids":["CVE-2026-102093"],"payload":{"kind":"advisory","title":"Kiteworks Core improper privilege management","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.","evidence":"cve:CVE-2026-102093","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102093","aliases":["CVE-2026-102093"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:05.914Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mq6c-p42h-75j5","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102093","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:13:38.788522Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:05.914Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:06:49.237Z"}}},"related_cves":[{"value":"CVE-2026-102093","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102093","advisory_id":"b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","event_types":["advisory"],"published_at":"2026-10-24T22:11:03.173293+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:06:49.237+00:00","detail_url":"/advisories/advisory%3Ab3d6036c-0393-4f7a-8de4-731a3f6e3fb6","group":{"id":"advisory:b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","revision":1,"primary_event_id":5617,"change":"published","superseded_by":[],"changed":{"id":5617,"cve_ids":["CVE-2026-102093"],"payload":{"kind":"advisory","title":"Kiteworks Core improper privilege management","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.","evidence":"cve:CVE-2026-102093","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102093","aliases":["CVE-2026-102093"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:05.914Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mq6c-p42h-75j5","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102093","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:13:38.788522Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:05.914Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:06:49.237Z"}}},"related_cves":[{"value":"CVE-2026-102093","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102093","advisory_id":"b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","event_types":["advisory"],"published_at":"2026-10-24T22:11:03.173293+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:06:49.237+00:00","detail_url":"/events/5617"},"members":[{"id":5617,"cve_ids":["CVE-2026-102093"],"payload":{"kind":"advisory","title":"Kiteworks Core improper privilege management","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.","evidence":"cve:CVE-2026-102093","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102093","aliases":["CVE-2026-102093"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:05.914Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mq6c-p42h-75j5","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102093","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:13:38.788522Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:05.914Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:06:49.237Z"}}},"related_cves":[{"value":"CVE-2026-102093","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102093","advisory_id":"b3d6036c-0393-4f7a-8de4-731a3f6e3fb6","event_types":["advisory"],"published_at":"2026-10-24T22:11:03.173293+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:06:49.237+00:00","detail_url":"/events/5617"}]}},{"id":5595,"cve_ids":["CVE-2026-102092"],"payload":{"kind":"advisory","title":"Kiteworks Core stored XSS","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.","evidence":"cve:CVE-2026-102092","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102092","aliases":["CVE-2026-102092"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:06.066Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mhw9-vrqq-m434","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102092","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:14:25.278439Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:06.066Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:06:03.127Z"}}},"related_cves":[{"value":"CVE-2026-102092","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3f857298-04cc-47e1-af94-5568c4c507e2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102092","advisory_id":"3f857298-04cc-47e1-af94-5568c4c507e2","event_types":["advisory"],"published_at":"2026-10-24T22:11:02.584832+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:06:03.127+00:00","detail_url":"/advisories/advisory%3A3f857298-04cc-47e1-af94-5568c4c507e2","group":{"id":"advisory:3f857298-04cc-47e1-af94-5568c4c507e2","revision":1,"primary_event_id":5616,"change":"published","superseded_by":[],"changed":{"id":5616,"cve_ids":["CVE-2026-102092"],"payload":{"kind":"advisory","title":"Kiteworks Core stored XSS","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.","evidence":"cve:CVE-2026-102092","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102092","aliases":["CVE-2026-102092"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:06.066Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mhw9-vrqq-m434","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102092","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:14:25.278439Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:06.066Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:06:03.127Z"}}},"related_cves":[{"value":"CVE-2026-102092","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3f857298-04cc-47e1-af94-5568c4c507e2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102092","advisory_id":"3f857298-04cc-47e1-af94-5568c4c507e2","event_types":["advisory"],"published_at":"2026-10-24T22:11:02.584832+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:06:03.127+00:00","detail_url":"/events/5616"},"members":[{"id":5616,"cve_ids":["CVE-2026-102092"],"payload":{"kind":"advisory","title":"Kiteworks Core stored XSS","summary":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.","evidence":"cve:CVE-2026-102092","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102092","aliases":["CVE-2026-102092"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T15:28:06.066Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mhw9-vrqq-m434","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102092","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T15:14:25.278439Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:28:06.066Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:06:03.127Z"}}},"related_cves":[{"value":"CVE-2026-102092","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3f857298-04cc-47e1-af94-5568c4c507e2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102092","advisory_id":"3f857298-04cc-47e1-af94-5568c4c507e2","event_types":["advisory"],"published_at":"2026-10-24T22:11:02.584832+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:06:03.127+00:00","detail_url":"/events/5616"}]}},{"id":5151,"cve_ids":["CVE-2026-102147"],"payload":{"kind":"advisory","title":"Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)","summary":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.","evidence":"cve:CVE-2026-102147","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102147","aliases":["CVE-2026-102147"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:08.098Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102147","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:51.123845Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:08.098Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:09:08.315Z"}}},"related_cves":[{"value":"CVE-2026-102147","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a254c652-ac94-4374-9e59-72a8bf1ecd9c","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102147","advisory_id":"a254c652-ac94-4374-9e59-72a8bf1ecd9c","event_types":["advisory"],"published_at":"2026-10-24T22:04:30.331665+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:09:08.315+00:00","detail_url":"/advisories/advisory%3Aa254c652-ac94-4374-9e59-72a8bf1ecd9c","group":{"id":"advisory:a254c652-ac94-4374-9e59-72a8bf1ecd9c","revision":1,"primary_event_id":5176,"change":"published","superseded_by":[],"changed":{"id":5176,"cve_ids":["CVE-2026-102147"],"payload":{"kind":"advisory","title":"Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)","summary":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.","evidence":"cve:CVE-2026-102147","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102147","aliases":["CVE-2026-102147"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:08.098Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102147","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:51.123845Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:08.098Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:09:08.315Z"}}},"related_cves":[{"value":"CVE-2026-102147","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a254c652-ac94-4374-9e59-72a8bf1ecd9c","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102147","advisory_id":"a254c652-ac94-4374-9e59-72a8bf1ecd9c","event_types":["advisory"],"published_at":"2026-10-24T22:04:30.331665+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:09:08.315+00:00","detail_url":"/events/5176"},"members":[{"id":5176,"cve_ids":["CVE-2026-102147"],"payload":{"kind":"advisory","title":"Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)","summary":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.","evidence":"cve:CVE-2026-102147","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102147","aliases":["CVE-2026-102147"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:08.098Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102147","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:51.123845Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:08.098Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:09:08.315Z"}}},"related_cves":[{"value":"CVE-2026-102147","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a254c652-ac94-4374-9e59-72a8bf1ecd9c","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102147","advisory_id":"a254c652-ac94-4374-9e59-72a8bf1ecd9c","event_types":["advisory"],"published_at":"2026-10-24T22:04:30.331665+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:09:08.315+00:00","detail_url":"/events/5176"}]}},{"id":5149,"cve_ids":["CVE-2026-102145"],"payload":{"kind":"advisory","title":"Kiteworks Core Server-Side Request Forgery through CRLF Injection","summary":"An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.","evidence":"cve:CVE-2026-102145","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102145","aliases":["CVE-2026-102145"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:08.392Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102145","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:25:32.312235Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:08.392Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:08:34.493Z"}}},"related_cves":[{"value":"CVE-2026-102145","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:66b433f5-94a1-4341-a99d-397a8db92ab7","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102145","advisory_id":"66b433f5-94a1-4341-a99d-397a8db92ab7","event_types":["advisory"],"published_at":"2026-10-24T22:04:29.123314+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:08:34.493+00:00","detail_url":"/advisories/advisory%3A66b433f5-94a1-4341-a99d-397a8db92ab7","group":{"id":"advisory:66b433f5-94a1-4341-a99d-397a8db92ab7","revision":1,"primary_event_id":5174,"change":"published","superseded_by":[],"changed":{"id":5174,"cve_ids":["CVE-2026-102145"],"payload":{"kind":"advisory","title":"Kiteworks Core Server-Side Request Forgery through CRLF Injection","summary":"An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.","evidence":"cve:CVE-2026-102145","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102145","aliases":["CVE-2026-102145"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:08.392Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102145","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:25:32.312235Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:08.392Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:08:34.493Z"}}},"related_cves":[{"value":"CVE-2026-102145","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:66b433f5-94a1-4341-a99d-397a8db92ab7","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102145","advisory_id":"66b433f5-94a1-4341-a99d-397a8db92ab7","event_types":["advisory"],"published_at":"2026-10-24T22:04:29.123314+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:08:34.493+00:00","detail_url":"/events/5174"},"members":[{"id":5174,"cve_ids":["CVE-2026-102145"],"payload":{"kind":"advisory","title":"Kiteworks Core Server-Side Request Forgery through CRLF Injection","summary":"An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.","evidence":"cve:CVE-2026-102145","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102145","aliases":["CVE-2026-102145"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:08.392Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102145","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:25:32.312235Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:08.392Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:08:34.493Z"}}},"related_cves":[{"value":"CVE-2026-102145","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:66b433f5-94a1-4341-a99d-397a8db92ab7","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102145","advisory_id":"66b433f5-94a1-4341-a99d-397a8db92ab7","event_types":["advisory"],"published_at":"2026-10-24T22:04:29.123314+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:08:34.493+00:00","detail_url":"/events/5174"}]}},{"id":5148,"cve_ids":["CVE-2026-102140"],"payload":{"kind":"advisory","title":"Kiteworks Core Insufficient Verification of Data Authenticity","summary":"An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.","evidence":"cve:CVE-2026-102140","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102140","aliases":["CVE-2026-102140"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.652Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102140","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:16.635969Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.652Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:07.754Z"}}},"related_cves":[{"value":"CVE-2026-102140","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60232aef-7710-4ace-8ade-03b374dcb3ed","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102140","advisory_id":"60232aef-7710-4ace-8ade-03b374dcb3ed","event_types":["advisory"],"published_at":"2026-10-24T22:04:28.30644+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:07.754+00:00","detail_url":"/advisories/advisory%3A60232aef-7710-4ace-8ade-03b374dcb3ed","group":{"id":"advisory:60232aef-7710-4ace-8ade-03b374dcb3ed","revision":1,"primary_event_id":5173,"change":"published","superseded_by":[],"changed":{"id":5173,"cve_ids":["CVE-2026-102140"],"payload":{"kind":"advisory","title":"Kiteworks Core Insufficient Verification of Data Authenticity","summary":"An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.","evidence":"cve:CVE-2026-102140","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102140","aliases":["CVE-2026-102140"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.652Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102140","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:16.635969Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.652Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:07.754Z"}}},"related_cves":[{"value":"CVE-2026-102140","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60232aef-7710-4ace-8ade-03b374dcb3ed","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102140","advisory_id":"60232aef-7710-4ace-8ade-03b374dcb3ed","event_types":["advisory"],"published_at":"2026-10-24T22:04:28.30644+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:07.754+00:00","detail_url":"/events/5173"},"members":[{"id":5173,"cve_ids":["CVE-2026-102140"],"payload":{"kind":"advisory","title":"Kiteworks Core Insufficient Verification of Data Authenticity","summary":"An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.","evidence":"cve:CVE-2026-102140","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102140","aliases":["CVE-2026-102140"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.652Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102140","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:16.635969Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.652Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:07.754Z"}}},"related_cves":[{"value":"CVE-2026-102140","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60232aef-7710-4ace-8ade-03b374dcb3ed","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102140","advisory_id":"60232aef-7710-4ace-8ade-03b374dcb3ed","event_types":["advisory"],"published_at":"2026-10-24T22:04:28.30644+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:07.754+00:00","detail_url":"/events/5173"}]}},{"id":5147,"cve_ids":["CVE-2026-102138"],"payload":{"kind":"advisory","title":"Kiteworks Core Server-Side Request Forgery (SSRF)","summary":"An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.","evidence":"cve:CVE-2026-102138","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-102138","aliases":["CVE-2026-102138"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.204Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q9w9-c5hj-87jm","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102138","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:39.154554Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.204Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:32.172Z"}}},"related_cves":[{"value":"CVE-2026-102138","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bdfae84a-f4cf-487b-8243-de348050fb39","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102138","advisory_id":"bdfae84a-f4cf-487b-8243-de348050fb39","event_types":["advisory"],"published_at":"2026-10-24T22:04:27.700515+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:32.172+00:00","detail_url":"/advisories/advisory%3Abdfae84a-f4cf-487b-8243-de348050fb39","group":{"id":"advisory:bdfae84a-f4cf-487b-8243-de348050fb39","revision":1,"primary_event_id":5172,"change":"published","superseded_by":[],"changed":{"id":5172,"cve_ids":["CVE-2026-102138"],"payload":{"kind":"advisory","title":"Kiteworks Core Server-Side Request Forgery (SSRF)","summary":"An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.","evidence":"cve:CVE-2026-102138","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-102138","aliases":["CVE-2026-102138"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.204Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q9w9-c5hj-87jm","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102138","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:39.154554Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.204Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:32.172Z"}}},"related_cves":[{"value":"CVE-2026-102138","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bdfae84a-f4cf-487b-8243-de348050fb39","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102138","advisory_id":"bdfae84a-f4cf-487b-8243-de348050fb39","event_types":["advisory"],"published_at":"2026-10-24T22:04:27.700515+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:32.172+00:00","detail_url":"/events/5172"},"members":[{"id":5172,"cve_ids":["CVE-2026-102138"],"payload":{"kind":"advisory","title":"Kiteworks Core Server-Side Request Forgery (SSRF)","summary":"An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.","evidence":"cve:CVE-2026-102138","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-102138","aliases":["CVE-2026-102138"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.204Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q9w9-c5hj-87jm","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102138","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:26:39.154554Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.204Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:32.172Z"}}},"related_cves":[{"value":"CVE-2026-102138","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bdfae84a-f4cf-487b-8243-de348050fb39","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102138","advisory_id":"bdfae84a-f4cf-487b-8243-de348050fb39","event_types":["advisory"],"published_at":"2026-10-24T22:04:27.700515+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:32.172+00:00","detail_url":"/events/5172"}]}},{"id":5145,"cve_ids":["CVE-2026-102137"],"payload":{"kind":"advisory","title":"Kiteworks Core Unrestricted Upload of File with Dangerous Type","summary":"An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.","evidence":"cve:CVE-2026-102137","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102137","aliases":["CVE-2026-102137"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.054Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m6cv-4pjv-7435","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102137","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:38.606633Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.054Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:52.485Z"}}},"related_cves":[{"value":"CVE-2026-102137","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3a8725d0-419e-4332-aed2-12cca1b28706","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102137","advisory_id":"3a8725d0-419e-4332-aed2-12cca1b28706","event_types":["advisory"],"published_at":"2026-10-24T22:04:26.541306+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:52.485+00:00","detail_url":"/advisories/advisory%3A3a8725d0-419e-4332-aed2-12cca1b28706","group":{"id":"advisory:3a8725d0-419e-4332-aed2-12cca1b28706","revision":1,"primary_event_id":5170,"change":"published","superseded_by":[],"changed":{"id":5170,"cve_ids":["CVE-2026-102137"],"payload":{"kind":"advisory","title":"Kiteworks Core Unrestricted Upload of File with Dangerous Type","summary":"An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.","evidence":"cve:CVE-2026-102137","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102137","aliases":["CVE-2026-102137"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.054Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m6cv-4pjv-7435","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102137","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:38.606633Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.054Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:52.485Z"}}},"related_cves":[{"value":"CVE-2026-102137","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3a8725d0-419e-4332-aed2-12cca1b28706","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102137","advisory_id":"3a8725d0-419e-4332-aed2-12cca1b28706","event_types":["advisory"],"published_at":"2026-10-24T22:04:26.541306+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:52.485+00:00","detail_url":"/events/5170"},"members":[{"id":5170,"cve_ids":["CVE-2026-102137"],"payload":{"kind":"advisory","title":"Kiteworks Core Unrestricted Upload of File with Dangerous Type","summary":"An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.","evidence":"cve:CVE-2026-102137","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102137","aliases":["CVE-2026-102137"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:07.054Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m6cv-4pjv-7435","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102137","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:38.606633Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:07.054Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:11:52.485Z"}}},"related_cves":[{"value":"CVE-2026-102137","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3a8725d0-419e-4332-aed2-12cca1b28706","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102137","advisory_id":"3a8725d0-419e-4332-aed2-12cca1b28706","event_types":["advisory"],"published_at":"2026-10-24T22:04:26.541306+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:11:52.485+00:00","detail_url":"/events/5170"}]}},{"id":5144,"cve_ids":["CVE-2026-102136"],"payload":{"kind":"advisory","title":"Kiteworks Core Command Execution through Configuration Injection","summary":"In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.","evidence":"cve:CVE-2026-102136","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102136","aliases":["CVE-2026-102136"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.3,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.915Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rpxx-jm93-w5j7","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102136","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:21.585395Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.915Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:12:07.108Z"}}},"related_cves":[{"value":"CVE-2026-102136","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98a533ef-d332-4334-82d3-2e19d5e7397d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102136","advisory_id":"98a533ef-d332-4334-82d3-2e19d5e7397d","event_types":["advisory"],"published_at":"2026-10-24T22:04:25.961955+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:12:07.108+00:00","detail_url":"/advisories/advisory%3A98a533ef-d332-4334-82d3-2e19d5e7397d","group":{"id":"advisory:98a533ef-d332-4334-82d3-2e19d5e7397d","revision":1,"primary_event_id":5169,"change":"published","superseded_by":[],"changed":{"id":5169,"cve_ids":["CVE-2026-102136"],"payload":{"kind":"advisory","title":"Kiteworks Core Command Execution through Configuration Injection","summary":"In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.","evidence":"cve:CVE-2026-102136","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102136","aliases":["CVE-2026-102136"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.3,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.915Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rpxx-jm93-w5j7","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102136","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:21.585395Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.915Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:12:07.108Z"}}},"related_cves":[{"value":"CVE-2026-102136","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98a533ef-d332-4334-82d3-2e19d5e7397d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102136","advisory_id":"98a533ef-d332-4334-82d3-2e19d5e7397d","event_types":["advisory"],"published_at":"2026-10-24T22:04:25.961955+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:12:07.108+00:00","detail_url":"/events/5169"},"members":[{"id":5169,"cve_ids":["CVE-2026-102136"],"payload":{"kind":"advisory","title":"Kiteworks Core Command Execution through Configuration Injection","summary":"In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.","evidence":"cve:CVE-2026-102136","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102136","aliases":["CVE-2026-102136"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.3,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.915Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rpxx-jm93-w5j7","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102136","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:21.585395Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.915Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:12:07.108Z"}}},"related_cves":[{"value":"CVE-2026-102136","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98a533ef-d332-4334-82d3-2e19d5e7397d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102136","advisory_id":"98a533ef-d332-4334-82d3-2e19d5e7397d","event_types":["advisory"],"published_at":"2026-10-24T22:04:25.961955+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:12:07.108+00:00","detail_url":"/events/5169"}]}},{"id":5142,"cve_ids":["CVE-2026-102134"],"payload":{"kind":"advisory","title":"Kiteworks Core Unprotected Alternate Channel","summary":"Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.","evidence":"cve:CVE-2026-102134","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102134","aliases":["CVE-2026-102134"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.623Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8q58-vrwm-jxhq","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:56.398419Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.623Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:12:39.707Z"}}},"related_cves":[{"value":"CVE-2026-102134","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102134","advisory_id":"74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","event_types":["advisory"],"published_at":"2026-10-24T22:04:24.796453+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:12:39.707+00:00","detail_url":"/advisories/advisory%3A74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","group":{"id":"advisory:74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","revision":1,"primary_event_id":5167,"change":"published","superseded_by":[],"changed":{"id":5167,"cve_ids":["CVE-2026-102134"],"payload":{"kind":"advisory","title":"Kiteworks Core Unprotected Alternate Channel","summary":"Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.","evidence":"cve:CVE-2026-102134","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102134","aliases":["CVE-2026-102134"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.623Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8q58-vrwm-jxhq","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:56.398419Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.623Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:12:39.707Z"}}},"related_cves":[{"value":"CVE-2026-102134","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102134","advisory_id":"74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","event_types":["advisory"],"published_at":"2026-10-24T22:04:24.796453+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:12:39.707+00:00","detail_url":"/events/5167"},"members":[{"id":5167,"cve_ids":["CVE-2026-102134"],"payload":{"kind":"advisory","title":"Kiteworks Core Unprotected Alternate Channel","summary":"Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.","evidence":"cve:CVE-2026-102134","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102134","aliases":["CVE-2026-102134"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.623Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8q58-vrwm-jxhq","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:56.398419Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.623Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:12:39.707Z"}}},"related_cves":[{"value":"CVE-2026-102134","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102134","advisory_id":"74da9ead-e1bd-40ce-a8b5-75d10bde8ca1","event_types":["advisory"],"published_at":"2026-10-24T22:04:24.796453+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:12:39.707+00:00","detail_url":"/events/5167"}]}},{"id":5141,"cve_ids":["CVE-2026-102132"],"payload":{"kind":"advisory","title":"Kiteworks Core Privilege Escalation through Improper Access Control","summary":"An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.","evidence":"cve:CVE-2026-102132","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102132","aliases":["CVE-2026-102132"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.034Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qx8c-x3hv-c25g","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102132","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:28:44.870292Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.034Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:38:31.422Z"}}},"related_cves":[{"value":"CVE-2026-102132","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102132","advisory_id":"342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","event_types":["advisory"],"published_at":"2026-10-24T22:04:24.225931+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:13:28.434+00:00","detail_url":"/advisories/advisory%3A342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","group":{"id":"advisory:342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","revision":1,"primary_event_id":5166,"change":"published","superseded_by":[],"changed":{"id":5166,"cve_ids":["CVE-2026-102132"],"payload":{"kind":"advisory","title":"Kiteworks Core Privilege Escalation through Improper Access Control","summary":"An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.","evidence":"cve:CVE-2026-102132","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102132","aliases":["CVE-2026-102132"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.034Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qx8c-x3hv-c25g","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102132","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:28:44.870292Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.034Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:38:31.422Z"}}},"related_cves":[{"value":"CVE-2026-102132","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102132","advisory_id":"342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","event_types":["advisory"],"published_at":"2026-10-24T22:04:24.225931+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:13:28.434+00:00","detail_url":"/events/5166"},"members":[{"id":5166,"cve_ids":["CVE-2026-102132"],"payload":{"kind":"advisory","title":"Kiteworks Core Privilege Escalation through Improper Access Control","summary":"An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.","evidence":"cve:CVE-2026-102132","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102132","aliases":["CVE-2026-102132"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.034Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qx8c-x3hv-c25g","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102132","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:28:44.870292Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.034Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:38:31.422Z"}}},"related_cves":[{"value":"CVE-2026-102132","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102132","advisory_id":"342a0e3d-fba9-42d0-b0e2-7e5869ebaa87","event_types":["advisory"],"published_at":"2026-10-24T22:04:24.225931+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:13:28.434+00:00","detail_url":"/events/5166"}]}},{"id":5140,"cve_ids":["CVE-2026-102133"],"payload":{"kind":"advisory","title":"Kiteworks Core Arbitrary File Write through Command Injection","summary":"An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.","evidence":"cve:CVE-2026-102133","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102133","aliases":["CVE-2026-102133"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.177Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102133","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:37.406475Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.177Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:13:09.677Z"}}},"related_cves":[{"value":"CVE-2026-102133","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f70a23ac-544c-42c7-9f80-3307c1641f89","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102133","advisory_id":"f70a23ac-544c-42c7-9f80-3307c1641f89","event_types":["advisory"],"published_at":"2026-10-24T22:04:23.618519+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:13:09.677+00:00","detail_url":"/advisories/advisory%3Af70a23ac-544c-42c7-9f80-3307c1641f89","group":{"id":"advisory:f70a23ac-544c-42c7-9f80-3307c1641f89","revision":1,"primary_event_id":5165,"change":"published","superseded_by":[],"changed":{"id":5165,"cve_ids":["CVE-2026-102133"],"payload":{"kind":"advisory","title":"Kiteworks Core Arbitrary File Write through Command Injection","summary":"An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.","evidence":"cve:CVE-2026-102133","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102133","aliases":["CVE-2026-102133"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.177Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102133","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:37.406475Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.177Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:13:09.677Z"}}},"related_cves":[{"value":"CVE-2026-102133","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f70a23ac-544c-42c7-9f80-3307c1641f89","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102133","advisory_id":"f70a23ac-544c-42c7-9f80-3307c1641f89","event_types":["advisory"],"published_at":"2026-10-24T22:04:23.618519+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:13:09.677+00:00","detail_url":"/events/5165"},"members":[{"id":5165,"cve_ids":["CVE-2026-102133"],"payload":{"kind":"advisory","title":"Kiteworks Core Arbitrary File Write through Command Injection","summary":"An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control.","evidence":"cve:CVE-2026-102133","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102133","aliases":["CVE-2026-102133"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:06.177Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102133","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:37.406475Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:06.177Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:13:09.677Z"}}},"related_cves":[{"value":"CVE-2026-102133","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f70a23ac-544c-42c7-9f80-3307c1641f89","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102133","advisory_id":"f70a23ac-544c-42c7-9f80-3307c1641f89","event_types":["advisory"],"published_at":"2026-10-24T22:04:23.618519+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:13:09.677+00:00","detail_url":"/events/5165"}]}},{"id":5137,"cve_ids":["CVE-2026-102129"],"payload":{"kind":"advisory","title":"Kiteworks Core Incorrect Privilege Assignment","summary":"A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.","evidence":"cve:CVE-2026-102129","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102129","aliases":["CVE-2026-102129"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:05.610Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102129","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:28:22.003260Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:05.610Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:14:13.681Z"}}},"related_cves":[{"value":"CVE-2026-102129","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102129","advisory_id":"cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","event_types":["advisory"],"published_at":"2026-10-24T22:04:21.781366+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:14:13.681+00:00","detail_url":"/advisories/advisory%3Acd2be04b-769a-4c7f-96c9-fd4177ab4ea8","group":{"id":"advisory:cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","revision":1,"primary_event_id":5162,"change":"published","superseded_by":[],"changed":{"id":5162,"cve_ids":["CVE-2026-102129"],"payload":{"kind":"advisory","title":"Kiteworks Core Incorrect Privilege Assignment","summary":"A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.","evidence":"cve:CVE-2026-102129","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102129","aliases":["CVE-2026-102129"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:05.610Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102129","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:28:22.003260Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:05.610Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:14:13.681Z"}}},"related_cves":[{"value":"CVE-2026-102129","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102129","advisory_id":"cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","event_types":["advisory"],"published_at":"2026-10-24T22:04:21.781366+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:14:13.681+00:00","detail_url":"/events/5162"},"members":[{"id":5162,"cve_ids":["CVE-2026-102129"],"payload":{"kind":"advisory","title":"Kiteworks Core Incorrect Privilege Assignment","summary":"A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.","evidence":"cve:CVE-2026-102129","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102129","aliases":["CVE-2026-102129"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:05.610Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102129","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:28:22.003260Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:05.610Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:14:13.681Z"}}},"related_cves":[{"value":"CVE-2026-102129","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102129","advisory_id":"cd2be04b-769a-4c7f-96c9-fd4177ab4ea8","event_types":["advisory"],"published_at":"2026-10-24T22:04:21.781366+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:14:13.681+00:00","detail_url":"/events/5162"}]}},{"id":5134,"cve_ids":["CVE-2026-102126"],"payload":{"kind":"advisory","title":"Kiteworks Core Stored Cross-site Scripting (XSS)","summary":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.","evidence":"cve:CVE-2026-102126","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102126","aliases":["CVE-2026-102126"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:05.091Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-ccfx-6hq4-fx4g","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102126","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:15.630566Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:05.091Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:15:09.284Z"}}},"related_cves":[{"value":"CVE-2026-102126","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5063c9d4-094b-4016-8ed8-b45a23e9088e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102126","advisory_id":"5063c9d4-094b-4016-8ed8-b45a23e9088e","event_types":["advisory"],"published_at":"2026-10-24T22:04:19.327541+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:15:09.284+00:00","detail_url":"/advisories/advisory%3A5063c9d4-094b-4016-8ed8-b45a23e9088e","group":{"id":"advisory:5063c9d4-094b-4016-8ed8-b45a23e9088e","revision":1,"primary_event_id":5159,"change":"published","superseded_by":[],"changed":{"id":5159,"cve_ids":["CVE-2026-102126"],"payload":{"kind":"advisory","title":"Kiteworks Core Stored Cross-site Scripting (XSS)","summary":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.","evidence":"cve:CVE-2026-102126","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102126","aliases":["CVE-2026-102126"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:05.091Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-ccfx-6hq4-fx4g","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102126","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:15.630566Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:05.091Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:15:09.284Z"}}},"related_cves":[{"value":"CVE-2026-102126","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5063c9d4-094b-4016-8ed8-b45a23e9088e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102126","advisory_id":"5063c9d4-094b-4016-8ed8-b45a23e9088e","event_types":["advisory"],"published_at":"2026-10-24T22:04:19.327541+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:15:09.284+00:00","detail_url":"/events/5159"},"members":[{"id":5159,"cve_ids":["CVE-2026-102126"],"payload":{"kind":"advisory","title":"Kiteworks Core Stored Cross-site Scripting (XSS)","summary":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.","evidence":"cve:CVE-2026-102126","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102126","aliases":["CVE-2026-102126"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.1","versionType":"custom"},{"status":"unaffected","version":"9.5.1"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:05.091Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-ccfx-6hq4-fx4g","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102126","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:24:15.630566Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:05.091Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:15:09.284Z"}}},"related_cves":[{"value":"CVE-2026-102126","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5063c9d4-094b-4016-8ed8-b45a23e9088e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102126","advisory_id":"5063c9d4-094b-4016-8ed8-b45a23e9088e","event_types":["advisory"],"published_at":"2026-10-24T22:04:19.327541+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:15:09.284+00:00","detail_url":"/events/5159"}]}},{"id":5133,"cve_ids":["CVE-2026-102125"],"payload":{"kind":"advisory","title":"Kiteworks Core Sandbox Escape","summary":"The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.","evidence":"cve:CVE-2026-102125","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102125","aliases":["CVE-2026-102125"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:04.940Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102125","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:07.249739Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:04.940Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:15:25.475Z"}}},"related_cves":[{"value":"CVE-2026-102125","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fd0b28c6-5a29-4dfe-94f7-36669b92deb4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102125","advisory_id":"fd0b28c6-5a29-4dfe-94f7-36669b92deb4","event_types":["advisory"],"published_at":"2026-10-24T22:03:34.816159+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:15:25.475+00:00","detail_url":"/advisories/advisory%3Afd0b28c6-5a29-4dfe-94f7-36669b92deb4","group":{"id":"advisory:fd0b28c6-5a29-4dfe-94f7-36669b92deb4","revision":1,"primary_event_id":5158,"change":"published","superseded_by":[],"changed":{"id":5158,"cve_ids":["CVE-2026-102125"],"payload":{"kind":"advisory","title":"Kiteworks Core Sandbox Escape","summary":"The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.","evidence":"cve:CVE-2026-102125","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102125","aliases":["CVE-2026-102125"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:04.940Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102125","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:07.249739Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:04.940Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:15:25.475Z"}}},"related_cves":[{"value":"CVE-2026-102125","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fd0b28c6-5a29-4dfe-94f7-36669b92deb4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102125","advisory_id":"fd0b28c6-5a29-4dfe-94f7-36669b92deb4","event_types":["advisory"],"published_at":"2026-10-24T22:03:34.816159+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:15:25.475+00:00","detail_url":"/events/5158"},"members":[{"id":5158,"cve_ids":["CVE-2026-102125"],"payload":{"kind":"advisory","title":"Kiteworks Core Sandbox Escape","summary":"The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance.","evidence":"cve:CVE-2026-102125","products":[{"name":{"value":"Core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102125","aliases":["CVE-2026-102125"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Kiteworks","product":"Core","versions":[{"status":"affected","version":"0","lessThan":"9.5.0","versionType":"custom"},{"status":"unaffected","version":"9.5.0"}],"defaultStatus":"unknown"}],"modified":"2026-10-01T13:37:04.940Z","provider":"cve","references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102125","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T13:23:07.249739Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T13:37:04.940Z"}}],"cna":{"orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg","dateUpdated":"2026-09-30T20:15:25.475Z"}}},"related_cves":[{"value":"CVE-2026-102125","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fd0b28c6-5a29-4dfe-94f7-36669b92deb4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102125","advisory_id":"fd0b28c6-5a29-4dfe-94f7-36669b92deb4","event_types":["advisory"],"published_at":"2026-10-24T22:03:34.816159+00:00","technologies":["core","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T20:15:25.475+00:00","detail_url":"/events/5158"}]}}],"next_after":42500,"next_before":5133}