medium6.5
CVE-2026-102124
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration.
Impact
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Accellion | Kiteworks | before 9.5.0 |