Is CVE-2026-102115 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-102115?

CVE-2026-102115 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-102115

Description

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.