---
title: "Accellion kiteworks vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/accellion/kiteworks
type: product
description: "Accellion kiteworks has 83 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-09-30
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Accellion kiteworks vulnerabilities

Vendor: [Accellion](https://radicalnotion.ai/vendor/accellion)

- **Published CVEs:** 83
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 82
- **Average CVSS:** 7.2
- **First CVE:** 2018-05-24
- **Latest CVE:** 2026-09-30

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 9 |
| High | 46 |
| Medium | 27 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 8 |
| [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 7 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 |
| [CWE-306](https://radicalnotion.ai/cwe/cwe-306) | Missing Authentication for Critical Function | 6 |
| [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 5 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 4 |
| [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 3 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2018 | 1 |
| 2019 | 0 |
| 2020 | 0 |
| 2021 | 2 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 0 |
| 2025 | 1 |
| 2026 | 79 |

## Affected versions

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 9.5.0 | range | 30 |
| \< 9.5.1 | range | 30 |
| \< 9.3.0 | range | 9 |
| \< 9.2.0 | range | 4 |
| \< 9.2.1 | range | 4 |
| \< 2017.01.00 | range | 1 |
| \< 7.3.1 | range | 1 |
| \< 7.4.0 | range | 1 |
| \< 9.1.0 | range | 1 |
| 9.2.0 | range | 1 |
| 9.2.1 | range | 1 |
| 9.3.0 \<= v \< 9.5.1 | range | 1 |
| 9.5.1 | patched | 31 |
| 9.5.0 | patched | 30 |
| 9.3.0 | patched | 9 |
| 9.2.0 | patched | 4 |
| 9.2.1 | patched | 4 |
| 2017.01.00 | patched | 1 |
| 7.3.1 | patched | 1 |
| 7.4.0 | patched | 1 |
| 9.1.0 | patched | 1 |

## CVEs (first 30 of 83, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-102105 | Kiteworks Email Protection Gateway server-side request forgery | critical | 9.1 | No | No | Yes |
| CVE-2026-102106 | Kiteworks Email Protection Gateway improper authentication | critical | 9.1 | No | No | Yes |
| CVE-2026-102107 | Kiteworks Core user impersonation in a file-request feature | medium | 4.6 | No | No | Yes |
| CVE-2026-102108 | Kiteworks Email Protection Gateway deserialization of untrusted data | high | 7.2 | No | No | Yes |
| CVE-2026-102109 | Kiteworks Secure Data Forms SQL injection | high | 7.1 | No | No | Yes |
| CVE-2026-102110 | Missing authentication on a Kiteworks appliance setup function | medium | 5.9 | No | No | Yes |
| CVE-2026-102111 | Kiteworks Core Improper Validation of Specified Quantity in Input | medium | 4.9 | No | No | Yes |
| CVE-2026-102112 | Kiteworks Core Local Privilege Escalation | high | 7.8 | No | No | Yes |
| CVE-2026-102113 | Kiteworks Core Local Privilege Escalation | high | 7.8 | No | No | Yes |
| CVE-2026-102114 | Kiteworks Core OS Command Injection | high | 7.2 | No | No | Yes |
| CVE-2026-102115 | Kiteworks Core Authentication Bypass in the Password Reset Workflow | critical | 9.8 | No | No | Yes |
| CVE-2026-102116 | Kiteworks Email Protection Gateway Path Traversal | high | 7.2 | No | No | Yes |
| CVE-2026-102117 | Kiteworks Core Remote Code Execution | high | 7.2 | No | No | Yes |
| CVE-2026-102118 | Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation | high | 7.8 | No | No | Yes |
| CVE-2026-102119 | Kiteworks Email Protection Gateway Path Traversal | high | 7.2 | No | No | Yes |
| CVE-2026-102120 | Kiteworks Core OS Command Injection | high | 8.8 | No | No | Yes |
| CVE-2026-102121 | Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor | high | 8.6 | No | No | Yes |
| CVE-2026-102104 | Kiteworks Email Protection Gateway server-side request forgery | critical | 9.1 | No | No | Yes |
| CVE-2026-102122 | Kiteworks Core Incorrect Authorization | medium | 4.3 | No | No | Yes |
| CVE-2026-102123 | Kiteworks Core Path Traversal | high | 7.4 | No | No | Yes |
| CVE-2026-102103 | Kiteworks Email Protection Gateway server-side request forgery | critical | 9.1 | No | No | Yes |
| CVE-2026-102124 | Kiteworks Core Missing Authentication for Critical Function | medium | 6.5 | No | No | Yes |
| CVE-2026-102125 | Kiteworks Core Sandbox Escape | high | 8.8 | No | No | Yes |
| CVE-2026-102126 | Kiteworks Core Stored Cross-site Scripting (XSS) | high | 8.1 | No | No | Yes |
| CVE-2026-102127 | Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference | high | 7.0 | No | No | Yes |
| CVE-2026-102128 | Kiteworks Email Protection Gateway Improper Authentication | high | 7.5 | No | No | Yes |
| CVE-2026-102129 | Kiteworks Core Incorrect Privilege Assignment | high | 7.2 | No | No | Yes |
| CVE-2026-102130 | Kiteworks Email Protection Gateway Remote Code Execution | high | 7.2 | No | No | Yes |
| CVE-2026-102131 | Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity | high | 7.2 | No | No | Yes |
| CVE-2026-102132 | Kiteworks Core Privilege Escalation through Improper Access Control | high | 7.2 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Accellion kiteworks have?

Accellion kiteworks has 83 published CVE records since 2018.

### How many Accellion kiteworks CVEs are in CISA KEV?

None of Accellion kiteworks's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Accellion kiteworks vulnerabilities?

No Accellion kiteworks CVEs currently have a tracked public exploit in this dataset.

### Which versions of Accellion kiteworks are affected?

21 distinct Accellion kiteworks versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Accellion kiteworks CVEs?

Accellion kiteworks's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

### How many critical Accellion kiteworks vulnerabilities are there?

Accellion kiteworks has 9 critical and 46 high-severity CVEs.

### What is the average severity of Accellion kiteworks CVEs?

The average CVSS base score across Accellion kiteworks's scored CVEs is 7.2.

## Other products from this vendor

- [File Transfer Appliance](https://radicalnotion.ai/vendor/accellion/file-transfer-appliance) (20 CVEs)
- [secure file transfer appliance](https://radicalnotion.ai/vendor/accellion/secure-file-transfer-appliance) (7 CVEs)
- [FTA](https://radicalnotion.ai/vendor/accellion/fta) (6 CVEs)
- [kiteworks managed file transfer](https://radicalnotion.ai/vendor/accellion/kiteworks-managed-file-transfer) (4 CVEs)
- [kiteworks appliance](https://radicalnotion.ai/vendor/accellion/kiteworks-appliance) (3 CVEs)
- [Accellion FTA](https://radicalnotion.ai/vendor/accellion/accellion-fta) (2 CVEs)
- [FTP Server](https://radicalnotion.ai/vendor/accellion/ftp-server) (2 CVEs)
- [FTA 9\_12\_411 and earlier](https://radicalnotion.ai/vendor/accellion/fta-9-12-411-and-earlier) (1 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/accellion/kiteworks). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.