CVE-2026-24751 HIGH

CVE-2026-24751: Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Vendor Kiteworks
Product Secure Data Forms
Weakness CWE-79 · XSS
Published June 1, 2026
Last update June 2, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Key dates

02Disclosure timeline

June 1, 2026 CVE published
June 2, 2026 Record updated