accellion vulnerabilities

Recent CVEs affecting accellion products. 61 tracked.

accellion has 61 tracked vulnerabilities, 9 critical. A fixed release or vendor patch exists for 61. Most recent: 2026-09-30. Highest priority: CVE-2026-102115 (score 58/100).

• CVE-2026-102110 MEDIUM 5.9 UPGRADE An endpoint used during initial appliance setup did not require authentication and did not correctly enforce i
• CVE-2026-102117 HIGH 7.2 UPGRADE On deployments where the remote-support capability is licensed and enabled, an authenticated System Administra
• CVE-2026-102119 HIGH 7.2 UPGRADE A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administ
• CVE-2026-102136 MEDIUM 6.3 UPGRADE In multi-node deployments, an attacker who had already obtained code execution on one appliance node could sub
• CVE-2026-102137 MEDIUM 4.1 UPGRADE An authenticated administrator could bypass the content validation applied to an administrative file upload an
• CVE-2026-102138 LOW 3.3 UPGRADE An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supp
• CVE-2026-102140 MEDIUM 4.9 UPGRADE An authenticated administrator could initiate an administrative import using a file whose contents were not fu
• CVE-2026-102143 HIGH 7.5 UPGRADE An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance
• CVE-2026-102145 MEDIUM 6.6 UPGRADE An authenticated administrator could cause the server to issue requests to, and interact with, internal networ
• CVE-2026-102146 MEDIUM 6.5 UPGRADE An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could writ
• CVE-2026-102135 MEDIUM 6.6 UPGRADE On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the clus
• CVE-2026-102133 MEDIUM 6.6 UPGRADE An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special cha
• CVE-2026-102131 HIGH 7.2 UPGRADE Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recogni
• CVE-2026-102130 HIGH 7.2 UPGRADE Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowe
• CVE-2026-102129 HIGH 7.2 UPGRADE A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled
• CVE-2026-102128 HIGH 7.5 UPGRADE An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kite
• CVE-2026-102127 HIGH 7.0 UPGRADE An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references
• CVE-2026-102125 HIGH 8.8 UPGRADE The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running
• CVE-2026-102124 MEDIUM 6.5 UPGRADE A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial
• CVE-2026-102121 HIGH 8.6 UPGRADE A form-rendering interface in the Advanced Forms component is reachable without authentication so that publish
• CVE-2026-102116 HIGH 7.2 UPGRADE -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a fi
• CVE-2026-102109 HIGH 7.1 UPGRADE A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authentic
• CVE-2026-102108 HIGH 7.2 UPGRADE An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object
• CVE-2026-102106 CRITICAL 9.1 UPGRADE Improper authentication in a Kiteworks Email Protection Gateway administrative service
• CVE-2026-102105 CRITICAL 9.1 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF)
• CVE-2026-102104 CRITICAL 9.1 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF)
• CVE-2026-102103 CRITICAL 9.1 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF)
• CVE-2026-102102 CRITICAL 9.1 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF)
• CVE-2026-102097 HIGH 7.2 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution
• CVE-2026-102095 CRITICAL 9.1 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery
• CVE-2026-102094 HIGH 7.2 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not suffic
• CVE-2026-102091 HIGH 7.5 UPGRADE Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow
• CVE-2026-102089 HIGH 7.2 UPGRADE Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an admin
• CVE-2026-102141 MEDIUM 6.7 UPGRADE Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker
• CVE-2026-102100 HIGH 8.7 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting
• CVE-2026-102149 CRITICAL 9.4 UPGRADE Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned
• CVE-2026-102147 CRITICAL 9.3 UPGRADE A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to stor
• CVE-2026-102144 MEDIUM 5.3 UPGRADE A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote at
• CVE-2026-102142 HIGH 7.2 UPGRADE A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated exp
• CVE-2026-102139 MEDIUM 6.5 UPGRADE An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correc
• CVE-2026-102126 HIGH 8.1 UPGRADE A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a sin
• CVE-2026-102132 HIGH 7.2 UPGRADE An administrative import function in Kiteworks Core did not verify that the requesting administrator was entit
• CVE-2026-102134 MEDIUM 5.4 UPGRADE Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through th
• CVE-2026-102123 HIGH 7.4 UPGRADE A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, whi
• CVE-2026-102122 MEDIUM 4.3 UPGRADE Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign
• CVE-2026-102120 HIGH 8.8 UPGRADE A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code
• CVE-2026-102118 HIGH 7.8 UPGRADE A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell
• CVE-2026-102115 CRITICAL 9.8 UPGRADE Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow
• CVE-2026-102114 HIGH 7.2 UPGRADE A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to ex
• CVE-2026-102113 HIGH 7.8 UPGRADE A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execut
• CVE-2026-102112 HIGH 7.8 UPGRADE A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execut
• CVE-2026-102150 HIGH 7.2 UPGRADE A function in the Kiteworks Advanced Forms component was reachable without authentication
• CVE-2026-102111 MEDIUM 4.9 UPGRADE Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting
• CVE-2026-102107 MEDIUM 4.6 UPGRADE Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated use
• CVE-2026-102101 HIGH 8.1 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data
• CVE-2026-102099 HIGH 7.2 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write
• CVE-2026-102098 HIGH 7.2 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection
• CVE-2026-102096 HIGH 7.2 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated adminis
• CVE-2026-102093 HIGH 7.2 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enfo
• CVE-2026-102092 HIGH 8.7 UPGRADE Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an aut
• CVE-2026-102090 MEDIUM 4.3 UPGRADE Kiteworks Core before version 9.5.1 is vulnerable to Content Injection

FAQ

How do I fix accellion vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is accellion being exploited right now?

None of the tracked accellion CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which accellion CVE should I patch first?

CVE-2026-102115 currently ranks highest (58/100): Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow.

Products

• kiteworks

← Back to latest CVEs