Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-28 | 2 | Disclosure2 |
| 2026-04-09 | 1 | Disclosure1 |
CVE-2026-28271: Kiteworks / SSRF CVE-2026-28270: Kiteworks / Unrestricted Upload of File with Dangerous Type CVE-2026-28269: Kiteworks / Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') with @truffzor
Post summary
Three new Kiteworks CVEs are disclosed, covering SSRF, unrestricted file upload, and OS command injection.
CVE-2026-28271 Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections throu… https://www.cve.org/CVERecord?id=CVE-2026-28271
Post summary
A new CVE (CVE-2026-28271) affecting Kiteworks prior to version 9.2.0 enables SSRF bypass through configuration functionality, but no PoC, exploit, or patch details are provided.
CVE-2026-28271 Server-Side Request Forgery Bypass in Kiteworks PDN Prior to Version 9.2.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28271
Post summary
The text announces a Server‑Side Request Forgery bypass vulnerability (CVE‑2026‑28271) in Kiteworks PDN before version 9.2.0, providing basic technical details but no exploit or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | accellion | kiteworks | - | - | - |