{"id":"CVE-2026-102101","published":"2026-09-30T21:16:56.880","lastModified":"2026-10-01T14:17:13.800","description":"Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-x5hx-fgrp-prvf","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":[]}],"exploitRefs":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-x5hx-fgrp-prvf","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is a deserialization vulnerability in Kiteworks Core before version 9.5.0, which could allow remote code execution if an attacker can influence the data being deserialized.","exploitability":"Exploitation requires an attacker to influence the data, making it somewhat difficult but not impossible.","blast_radius":"If exploited, this could result in remote code execution on the appliance, potentially leading to full system compromise.","remediation":"Upgrade to Kiteworks Core 9.5.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","remote-code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:43:56.495Z"}}