PT-2026-45654 · Kiteworks · Kiteworks

Icare + 1 · CVE-2026-24782 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.3.0

Description Kiteworks is a private data network (PDN). Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms allow an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and certain global configuration parameters. SQL Injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database.

Recommendations Upgrade to version 9.3.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-24782

Affected Products

Kiteworks

References · 5

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24782 · Security Note
• https://t.me/cveNotify/165819 · Telegram Post
• https://twitter.com/CVEnew/status/2061590948216254589 · Twitter Post
• https://t.me/cveNotify/212739 · Telegram Post