Medium severity · published Jun 1, 2026
CVE-2026-24754
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
5.4
CVSS
0.1%
EPSS
No
On KEV
Description
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · kiteworks
< 9.3.0 · source: vendor
KI
Kiteworks · Accellion
before 9.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24754
Vendor Advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gxvv-hwgc-w7gh
More from security-advisories
8.8
CVE-2026-28269
Kiteworks Core has an OS Command Injection
8.8
CVE-2025-53939
Kiteworks Core is vulnerable to Improper Input Validation
8.8
CVE-2025-53900
Kiteworks MFT has a Privilege Defined With Unsafe Actions
8.1
CVE-2025-53896
Kiteworks MFT is vulnerable to Insufficient Session Expiration
7.2
CVE-2026-28270
Kiteworks Core has an Unrestricted Upload of File with Dangerous Type