CVE-2026-102109

Executive Summary

CVE-2026-102109 is a SQL injection vulnerability (CWE-89) in Kiteworks Secure Data Forms. During processing, a value derived from an authenticated user's stored account data is incorporated into a database query without proper sanitization, allowing an authenticated attacker to influence that value and inject SQL. The flaw has a CVSS v3.1 base score of 7.1 (High), requires an authenticated session (PR:L), and is constrained to deployments where a specific optional feature is in use; no public proof-of-concept, exploit code, or vendor patch is currently available.

Technical Analysis

The vulnerability resides in the Kiteworks Secure Data Forms component. Per the vulnerability description, the injection point is not a conventional request parameter but a value that originates from the authenticated user's stored account data and is later concatenated (or otherwise uncleaned) into a database query. This is a consequential architectural detail: the untrusted input is persisted in the application's data store first and consumed by the query later, which means the trust boundary is crossed at account-data write time, not at query execution time.

The injection mechanism follows the classic second-order (stored/persistent) SQL injection model:

1. An authenticated user supplies or modifies account data that is stored server-side. The description does not enumerate the specific account field, so the exact storage location is not asserted here.
2. At some subsequent point — described only as a query within Secure Data Forms — the stored value is read back and incorporated into a database query without sanitization.
3. Because the developer treats the stored value as trusted ("it came from our own database"), parameterization is presumed absent at the sink, and injection succeeds.

The CVSS vector indicates the attacker's position and the resulting impact asymmetry:

• AV:N (Network) — reachable remotely over the network rather than requiring local access.
• AC:L (Low) — no specialized conditions or race windows are required once the preconditions are met.
• PR:L (Low) — the attacker must be authenticated but needs only ordinary user privileges; no administrative role is implied.
• UI:N (None) — no victim interaction beyond the attacker's own session is required.
• S:U (Unchanged) — the exploit remains scoped to the vulnerable component's security authority; it does not itself cross a privilege boundary within the CVSS model.
• C:H (High) — complete loss of confidentiality. This is consistent with the query result set — and by extension data readable through the database connection — being exposed to the attacker.
• I:L (Low) — limited integrity impact, consistent with a read-oriented injection primitive or a constrained write surface deliberately limited by the deployment configuration.
• A:N (None) — no availability impact; the injection is not expected to disrupt service.

The High confidentiality / Low integrity / No availability profile is characteristic of SQL injection where the principal demonstrated impact is unauthorized data retrieval, with write capabilities partially constrained. The deployment precondition — "a specific optional feature is in use" — materially narrows the exposed population: instances without that feature enabled are not affected.

Kiteworks Secure Data Forms is a secure-forms capability (e.g., form-based data collection used in regulated-file-transfer and secure-collaboration workflows). This context matters for impact: such deployments typically handle controlled unclassified information, personally identifiable information, financial records, and regulated communications, so a confidentiality-weighted SQL injection is disproportionately severe relative to its base score where sensitive datasets reside in the same database.

At the date of this report, no patch has been identified from any tracked source (patch confidence 0/4), no Nuclei template or exploit code exists publicly, and the CVE has not been added to CISA's Known Exploited Vulnerabilities catalog. The CNA title field is empty, and affected version ranges are not published, so version-based asset scoping is not currently possible from authoritative data. EPSS has not yet been scored by FIRST.org and no value is asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (second-order SQL injection via stored account data), not from disclosed exploit code. No specific function names, endpoints, parameter names, or file paths are asserted because none appear in the source description.

1. Reconnaissance and target identification. The attacker identifies externally reachable Kiteworks Secure Data Forms deployments. Because the flaw requires an authenticated session, the attacker must first obtain valid low-privileged credentials — through self-registration where enabled, a purchased or leaked credential, or an existing legitimate account. Target selection is further constrained to deployments that have the specific optional feature enabled, since instances without it are not vulnerable.

2. Precondition establishment. The attacker authenticates and populates their account profile or form-related account data with the crafted value. Because the untrusted input is stored rather than submitted directly to the query, no immediate error or rejection is observed at this stage — this is the defining property of a second-order injection and is why it evades input filters placed solely at the initial submission boundary.

3. Triggering the flaw. The attacker performs the workflow that causes Secure Data Forms to read the stored account value back and embed it into a database query. At the vulnerability-class level, this is a SQL injection trigger: the stored value is interpreted as SQL syntax rather than data at the sink. The exact trigger action is not specified in available data.

4. Payload and execution method (class-level). Because no sanitization is applied to the stored value at the point of query construction, payloads follow standard SQL injection techniques — for example, boolean-based or UNION-based constructs intended to alter the query's result set, or time-delay constructs used to confirm injection where output is not directly reflected. The description does not disclose the database engine, query structure, or result-reflecting behavior, so the specific technique cannot be stated with certainty; the class of techniques is what applies.

5. Post-exploitation impact. Per the CVSS assessment, the primary outcome is High confidentiality loss — unauthorized read access to data reachable through the injected query, which in a secure-forms/secure-collaboration platform may include other users' form submissions or account records depending on query scope and database permissions. Integrity impact is rated Low, consistent with limited or configuration-constrained write capability. Availability impact is None. The attacker retains an authenticated foothold, and the stored nature of the payload means the injection can re-trigger on subsequent query executions, providing a degree of persistence without re-delivery.

Impact Assessment

The affected product is Kiteworks Secure Data Forms, deployed on-premises or in private cloud by organizations handling regulated and sensitive data. Blast radius is bounded by two gating conditions: (a) a valid authenticated session is required, and (b) only deployments with a specific optional feature enabled are exposed. Within that population, the confidentiality impact is rated High — a full loss of confidentiality for data reachable through the vulnerable query. Kiteworks environments typically centralize file transfer, secure email, and form-based data collection in a single platform, so a query executed by an application account may reach a data set larger than the initiating user's own records. The Low integrity rating implies the vulnerability is not assessed as a direct, unrestricted path to arbitrary data modification, and the None availability rating means no service disruption is expected.

The score of 7.1 (High) positions this as a serious but not critical vulnerability — the reduced base score is driven primarily by the PR:L and the deployment precondition, not by the confidentiality outcome, which is maximal. Business impact centers on regulatory exposure (data-protection and sector-specific regimes), the potential for exfiltration of sensitive form submissions or account data, and the reputational cost of a breach in a product whose core value proposition is secure data exchange.

Detection Guidance

Sigma Rule

title: Potential SQL Injection in Kiteworks Secure Data Forms via Stored Account Data
id: 7f3c9a21-4d8e-4b62-9c11-2a5e6f0d8b47
status: experimental
description: Detects application-layer indicators consistent with second-order SQL injection in Kiteworks Secure Data Forms, where stored account data reaches a database query without sanitization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102109
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: kiteworks
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_path:
    cs-uri-stem|contains:
      - '/forms'
      - '/securedataforms'
      - '/account'
  selection_payload:
    cs-uri-query|contains:
      - "' OR "
      - "' UNION "
      - "UNION SELECT"
      - "'; WAITFOR DELAY"
      - "SLEEP("
      - "BENCHMARK("
      - "information_schema"
  condition: selection_method and selection_path and selection_payload
falsepositives:
  - Legitimate form content containing SQL-like text
  - Security scanners and penetration testing
level: high
tags:
  - attack.t1190
  - cwe.89

YARA Rule

rule CVE_2026_102109_Kiteworks_SecureDataForms_SQLi
{
    meta:
        description = "Detects SQL injection payload patterns targeting Kiteworks Secure Data Forms stored account data (CVE-2026-102109)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102109"
        date = "2026-01-01"
        severity = "high"
        cwe = "CWE-89"

    strings:
        $s1 = "' OR " ascii nocase
        $s2 = "' UNION " ascii nocase
        $s3 = "UNION SELECT" ascii nocase
        $s4 = "information_schema" ascii nocase
        $s5 = "WAITFOR DELAY" ascii nocase
        $s6 = "BENCHMARK(" ascii nocase
        $s7 = "SLEEP(" ascii nocase
        $s8 = "Secure Data Forms" ascii nocase
        $s9 = "securedataforms" ascii nocase

    condition:
        uint32be(0) == 0x25504446 or
        (2 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)) or
        (any of ($s8, $s9) and 1 of ($s1, $s2, $s3, $s4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102109 Kiteworks Secure Data Forms SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/forms"; nocase; http.request_body; content:"UNION SELECT"; nocase; http.request_body; content:"information_schema"; nocase; classtype:web-application-attack; reference:cve,2026-102109; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102109; sid:2026102109; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-102109 Kiteworks Secure Data Forms SQLi - Time-Based Probe"; flow:established,to_server; http.request_body; content:"WAITFOR DELAY"; nocase; http.request_body; content:"SLEEP("; nocase; classtype:web-application-attack; reference:cve,2026-102109; sid:2026102110; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=10m
  [ authentication where event.action == "user_login" and event.outcome == "success" ]
  [ http where http.request.method in ("POST", "PUT", "PATCH")
      and http.request.body.content :
        ("*UNION SELECT*", "*information_schema*", "*WAITFOR DELAY*", "*SLEEP(*", "*BENCHMARK(*") ]

Splunk SPL Query

index=web sourcetype=kiteworks_access
| where match(lower(uri_path), "(forms|securedataforms|account)")
| where match(lower(form_data), "(union\s+select|information_schema|waitfor\s+delay|sleep\(|benchmark\(|'\s+or\s+1=1)")
| stats count values(uri_path) AS paths values(src_ip) AS sources values(user) AS users
        by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,web,sql_injection,">
  <rule id="102109" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.(forms|securedataforms|account)</field>
    <regex type="pcre2">(?i)(union\s+select|information_schema|waitfor\s+delay|benchmark\(|sleep\(|'\s+or\s+)</regex>
    <description>CVE-2026-102109: Possible SQL injection attempt against Kiteworks Secure Data Forms.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102109,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is published in the available data. The guidance below is therefore operational and defense-in-depth rather than vendor-confirmed remediation.

1. Immediate mitigations

   • Determine whether the specific optional feature required for exploitation is enabled in each Kiteworks Secure Data Forms deployment. Where the feature is not in active business use, disable it to remove the exposure entirely.
   • Restrict who can create or modify accounts and form-related account data; enforce least privilege and eliminate self-registration on internet-facing instances if that capability is not strictly required.
   • Place the Secure Data Forms interface behind network access controls (VPN, allow-listed source ranges) where operationally feasible, reducing the unauthenticated reachable surface even though the flaw requires authentication.
   • Apply virtual patching at the WAF/IPS layer for the SQL injection class — blocking UNION SELECT, information_schema references, and time-delay constructs in form- and account-related request bodies — while recognizing WAF signature evasion is possible and this is not a substitute for a fix.
   • Monitor Kiteworks vendor advisories continuously; no patch has been identified at the time of writing, so any vendor release notes referencing Secure Data Forms SQL handling should be treated as priority.

2. Patch/upgrade steps

   • No patch exists in tracked sources. There is currently no version to upgrade to on the basis of this CVE.
   • Establish a monitoring process against the Kiteworks security advisory channel and the NVD entry for CVE-2026-102109; apply vendor fixes immediately upon release.
   • Where the platform is deployed behind an integration or managed service, confirm with the provider which Kiteworks build is running and whether the affected optional feature is enabled.

3. Long-term hardening

   • Enforce parameterized queries / prepared statements as a mandatory development standard so that stored values are never concatenated into SQL — this addresses the root cause of a second-order injection, which input validation alone will not.
   • Adopt server-side input validation at the point of storage and output encoding/parameterization at the point of query construction; treat all database-resident data as untrusted when it originated from a user.
   • Deploy database activity monitoring and least-privilege database accounts for the application so that even a successful injection yields minimal readable data.
   • Maintain an inventory of optional features enabled per deployment, since feature-gated vulnerabilities like this one can silently widen the exposed population.
   • Integrate SQL injection test cases (including stored/second-order patterns) into secure SDLC and periodic penetration testing for secure-forms components.

References

• NVD — CVE-2026-102109: https://nvd.nist.gov/vuln/detail/CVE-2026-102109
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
• FIRST.org EPSS — not yet scored for this CVE: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-102109 not listed (as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Kiteworks security advisories: https://www.kiteworks.com/security/

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are known for CVE-2026-102109 at the time of this report.