VulnSocial

CVE-2026-102115

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-640

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-01: 210-01
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Daily CyberSecurity@Daily_CyberSec

    Kiteworks vulnerabilities fixed in 9.5.1 include CVE-2026-102115, a 9.8 password reset flaw that enables admin account takeover. Patch now. #Kiteworks #KiteworksVulnerabilities #CVE2026102115 #CVE2026102149 #CVE2026102147 #EmailSecurity #SSRF #PatchNow https://securityonline.info/kiteworks-vulnerabilities/

    10001279
    13.0K followersView on X
  • Atlas Threat Monitoring@ThreatAtlas

    Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-102115 Vendor → Unknown Severity → Critical — CVSS 9.8 Product → Unknown Date → 2026-09-30 A critical vulnerability (Weak Password Recovery Mechanism for Forgotten Password) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown

    0000026
    429 followersView on X

Explore more

Back to dashboard