CVE-2026-24751

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Score

CVSS 3.1 8.2 High

Status

Analyzed - security-advisories@github.com

Published

2026-06-01

Last modified

2026-06-02

Weaknesses

CWE-79

Affected products

• Kiteworks (Accellion)
• Secure Data Forms (Kiteworks)

References

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947