Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Kiteworks Secure Data Forms can be forced to contact internal services

CVE-2026-102091 · published 1 month ago
Summary

Versions of Kiteworks Secure Data Forms before 9.5.0 let anyone on the internet tell the server to reach out to other computers and then see the replies. This could expose information from systems that are supposed to be hidden behind your network. Update the product to version 9.5.0 or later to stop this behavior.

What to do
  • Update kiteworks secure data forms to version 9.5.0 or later.
Affected software
VendorProductAffected versions
kiteworks secure data forms < 9.5.0
Original advisory text
Kiteworks Secure Data Forms server-side request forgery
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published30 Sep 2026
Updated4 Nov 2026
First seen30 Sep 2026
Sources
CVE-2026-102091 · NVD
CVE-2026-102091 · MITRE
Track software like this
Free during beta