Loading vulnerability…
Password-reset authentication bypass in Kiteworks Core
CVE-2026-102115 is a weak password-recovery vulnerability in Kiteworks Core. Improper validation of a parameter submitted to the password-reset workflow could allow an unauthenticated attacker who knows a user's email address to reset that user's locally stored password without access to the emailed reset link. The attacker could then authenticate as the affected user, including an administrator.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could result in account takeover and unauthorized access with the affected user's privileges. Compromise of an administrative account could compromise application confidentiality, integrity, and availability; specific availability-disruption mechanisms are not established.
If you can’t patch tonight, do this now.
Until the update is installed, restrict access to affected Kiteworks installations to trusted users and networks. This is a general exposure-reduction measure, not a confirmed workaround for the password-reset flaw.
Patch, then assume compromise.
Apply the applicable Kiteworks Core security update. The Kiteworks product advisory recommends upgrading to version 9.5.1 or later; confirm the CVE-specific affected and fixed versions and upgrade instructions against the vendor security advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.