CVE-2026-28271

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:28

Type	Values Removed	Values Added
Summary		(es) Kiteworks es una red de datos privada (PDN). Antes de la versión 9.2.0, una vulnerabilidad en la funcionalidad de configuración de Kiteworks permite eludir las protecciones de SSRF a través de ataques de reencuadernación de DNS. Administradores maliciosos podrían explotar esto para acceder a servicios internos que deberían estar restringidos. La versión 9.2.0 contiene un parche para el problema.

04 Mar 2026, 19:49

Type	Values Removed	Values Added
References	~~() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87 -~~	() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87 - Vendor Advisory
First Time		Accellion kiteworks Accellion
CPE		cpe:2.3:a:accellion:kiteworks::::::::

27 Feb 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-27 21:16

Updated : 2026-06-17 10:28

NVD link : CVE-2026-28271

Mitre link : CVE-2026-28271

CVE.ORG link : CVE-2026-28271

JSON object : View

Products Affected

accellion

kiteworks

CWE

CWE-350

Reliance on Reverse DNS Resolution for a Security-Critical Action

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-28271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28271", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:27:32.310501Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kiteworks", "product": "security-advisories", "versions": [{"status": "affected", "version": "< 9.2.0"}]}]}], "published": "2026-02-27T21:16:18.550", "references": [{"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-350"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue."}, {"lang": "es", "value": "Kiteworks es una red de datos privada (PDN). Antes de la versi\u00f3n 9.2.0, una vulnerabilidad en la funcionalidad de configuraci\u00f3n de Kiteworks permite eludir las protecciones de SSRF a trav\u00e9s de ataques de reencuadernaci\u00f3n de DNS. Administradores maliciosos podr\u00edan explotar esto para acceder a servicios internos que deber\u00edan estar restringidos. La versi\u00f3n 9.2.0 contiene un parche para el problema."}], "lastModified": "2026-06-17T10:28:24.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B494C8D4-2D4B-4F5E-99C1-4CCE8DF6C911", "versionEndExcluding": "9.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}