PT-2026-22394 · Kiteworks · Kiteworks

Icare + 1 · Published 2026-02-27 · Updated 2026-04-09 · CVE-2026-28270

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.2.0

Description Kiteworks is a private data network (PDN). A configuration issue allows the upload of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system.

Recommendations Update to version 9.2.0 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-28270

GHSA-V8X9-VWG6-CJ45

Affected Products

Kiteworks

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28270.json · Exploit
• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28270 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28270 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2027623181352108422 · Twitter Post
• https://twitter.com/CVEnew/status/2027744242773225653 · Twitter Post
• https://t.me/cveNotify/154188 · Telegram Post
• https://twitter.com/Icare1337/status/2042240787102978142 · Twitter Post