CVE-2026-102115

Executive Summary

CVE-2026-102115 is a critical authentication bypass vulnerability (CWE-640, weak password recovery mechanism) in Kiteworks Core, a secure file sharing and content governance platform. The password reset workflow fails to correctly validate a submitted parameter, allowing an unauthenticated attacker who knows a victim's email address to reset that account's password without possessing the emailed reset link. Successful exploitation grants full account takeover — including administrative accounts — with a CVSS base score of 9.8, and no public patch, PoC, or workaround is currently available.

Technical Analysis

The vulnerability resides in the password reset workflow of Kiteworks Core. According to the NVD description, the application "did not correctly validate a parameter submitted to the password reset workflow." This is a classic instance of CWE-640: Weak Password Recovery Mechanism for Forgotten Password. The core flaw is that a server-side parameter governing the reset process is trusted without adequate validation, enabling an attacker to bypass the intended security control — namely, possession of the emailed reset link or token.

Password reset flows typically operate by: (1) the user requests a reset for a given email address; (2) the server generates a time-limited, single-use token and emails a link containing that token; (3) the user clicks the link, and the server validates the token before permitting a new password to be set. CWE-640 manifests when any of these validation steps can be circumvented. The description states the attacker "could potentially reset that account's password without access to the emailed reset link," which indicates the parameter validation gap allows the reset to be completed without proving possession of the emailed token or link.

Two key preconditions are stated in the description: the attacker must be unauthenticated (PR:N, no privileges required) and must know the email address of a user who has a "locally stored password." The reference to a locally stored password is significant — accounts federated to an external identity provider (e.g., SAML/OIDC SSO) may not rely on a local password credential, whereas accounts holding a local password are directly reachable by the reset logic. Because the attack requires no user interaction (UI:N) and no authentication (PR:N), and results in high confidentiality, integrity, and availability impact (C:H/I:H/A:H), the CVSS 3.1 base score is 9.8.

No affected version range, patch reference, or fixed version has been provided by any tracked source. The precise parameter name, endpoint path, and code-level validation logic are not disclosed in the available NVD description, and this report does not speculate on them. The vulnerability class (improper validation of a password-reset parameter leading to authentication bypass) and the attack mechanism (reset without the emailed link) are the authoritative technical facts available.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-102115 as of this writing; the attack chain below is inferred strictly from the vulnerability class described in the NVD text. Only components explicitly named in the description — the password reset workflow, the email address, the locally stored password, the emailed reset link, and the unvalidated parameter — are referenced.

1. Reconnaissance / target identification: The attacker identifies a Kiteworks Core instance exposed to the network. Because the CVSS vector is AV:N, the vulnerable password reset workflow is remotely reachable. The attacker enumerates or otherwise obtains valid user email addresses (e.g., through OSINT, prior breach data, or organizational knowledge). The description explicitly requires the attacker to know the email address of a user with a locally stored password — there is no stated requirement for any other credential.

2. Triggering the flaw class: The attacker initiates the password reset workflow for the targeted email address. The vulnerability class — improper validation of a parameter submitted to that workflow — is then triggered by supplying or manipulating the reset parameter such that the server proceeds without correctly validating it. This is the weak-recovery-mechanism class (CWE-640): the check that is supposed to bind the reset to the emailed link/token is either skipped or satisfied incorrectly.

3. Payload / execution method at the class level: Rather than retrieving the token from the victim's email inbox, the attacker submits a crafted reset request in which the vulnerable parameter fails to be validated as intended. The precise parameter name and request structure are not disclosed in the available data and are not fabricated here. The observable outcome, per the description, is that the account's password is reset "without access to the emailed reset link."

4. Post-exploitation impact: With the password reset, the attacker sets a new password and authenticates as the victim user. Because the flaw is not limited to low-privilege accounts, the description notes the takeover applies "including where the account holds administrative privileges." This yields valid-account access (MITRE T1078), enabling full administrative control of the Kiteworks Core instance, access to stored content, and potential lateral movement within the organization. The high integrity impact reflects the attacker's ability to change credentials and account state; the high availability impact reflects potential disruption or lockout of legitimate users.

Impact Assessment

The CVSS 3.1 base score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every metric contributes to severity: the attack is network-reachable (AV:N), requires no special conditions (AC:L), needs no prior authentication (PR:N), and requires no victim interaction (UI:N). The scope is unchanged (S:U), but confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H).

Business impact is severe. Kiteworks Core is a secure file sharing and content governance platform; compromise of user accounts — particularly administrative accounts — exposes sensitive shared files, configuration, and potentially governance/compliance data. An attacker with administrative control could modify access policies, exfiltrate content, create or alter accounts, and persist in the environment. Because the attacker only needs to know a target email address, the barrier to exploitation is low, and any account with a locally stored password is in scope. The blast radius spans all users relying on local password authentication on an affected deployment; SSO/federated-only accounts may be less exposed, but this is not confirmed by the available data. No CISA KEV listing, no EPSS score, and no observed exploitation in the wild are recorded in the provided intelligence.

Detection Guidance

Because Kiteworks Core is a self-hosted enterprise platform, detection should focus on the password reset workflow and authentication events. The rules below are generic to the vulnerability class (abnormal password reset and subsequent authentication) and should be tuned to local field names, as no endpoint or parameter names are disclosed.

Sigma Rule

title: Kiteworks Core Password Reset Abuse (CVE-2026-102115)
id: 3f9b7c2a-1e4d-4a8b-9c6f-2d5e8a1b0c73
status: experimental
description: Detects anomalous password reset completion and immediate authentication consistent with CVE-2026-102115 abuse in Kiteworks Core.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102115
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: kiteworks
detection:
  selection_reset:
    event:
      - password_reset_completed
      - password_reset_success
  selection_auth:
    event:
      - user_login
      - authentication_success
  timeframe: 5m
  condition: selection_reset and selection_auth
fields:
  - user.email
  - src.ip
  - user.role
falsepositives:
  - Legitimate user performing self-service password reset followed by login
level: high
tags:
  - attack.t1078
  - attack.initial_access
  - cve.2026.102115

YARA Rule

rule CVE_2026_102115_Kiteworks_Password_Reset_Exploit
{
    meta:
        description = "Detects HTTP request patterns targeting the Kiteworks Core password reset workflow (CVE-2026-102115)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102115"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $p1 = "password" ascii nocase
        $p2 = "reset" ascii nocase
        $p3 = "forgot" ascii nocase
        $m1 = "POST" ascii
        $m2 = "PUT" ascii
    condition:
        (uint16(0) == 0x2054 or uint16(0) == 0x5550) and
        any of ($m*) and (2 of ($p*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102115 Kiteworks Core Password Reset Parameter Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"password"; nocase; http.uri; content:"reset"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-102115; sid:2026102115; rev:1;)

Elastic Detection

sequence by user.email with maxspan=5m
  [any where event.action == "password_reset_completed"]
  [any where event.action == "user_login" or event.action == "authentication_success"]

Splunk SPL Query

index=kiteworks sourcetype=kiteworks:app
(event=password_reset_completed OR event=password_reset_success)
| join type=inner user_email
  [ search index=kiteworks sourcetype=kiteworks:app (event=user_login OR event=authentication_success)
    | rename user_email as user_email ]
| stats count values(src_ip) as src_ips values(user_role) as roles by user_email
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102115,">
  <rule id="1021151" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">password_reset_completed</field>
    <description>CVE-2026-102115: Kiteworks Core password reset completed - possible abuse.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="1021152" level="14">
    <if_sid>1021151</if_sid>
    <field name="user.role">admin</field>
    <description>CVE-2026-102115: Administrative account password reset - high-risk authentication bypass.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="1021153" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">authentication_success</field>
    <field name="auth.method">local_password</field>
    <description>CVE-2026-102115: Local password authentication following reset - verify legitimacy.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or official workaround is currently available in the provided intelligence.

1. Immediate mitigations:

• Restrict network access to the Kiteworks Core password reset workflow to trusted networks or VPN where operationally feasible, reducing the AV:N exposure.
• Enforce multi-factor authentication (MFA) on all accounts, especially administrative accounts, so that a reset password alone is insufficient to authenticate.
• Monitor and alert on password reset and authentication activity (see Detection Guidance) and investigate any reset not preceded by a legitimate user request or email link click.
• Disable or tightly control password reset for administrative accounts and prefer SSO/federated authentication for privileged users (accounts without a locally stored password are not in the described attack path).

2. Patch/upgrade steps:

• No patched version is identified. Monitor the Kiteworks vendor advisory and NVD entry for CVE-2026-102115 for a fixed release, and apply it as soon as it is published. Until then, treat affected deployments as unpatched.

3. Long-term hardening:

• Ensure password reset tokens are single-use, time-limited, cryptographically random, and bound to the requesting session; validate all reset parameters server-side.
• Adopt SSO/federation to eliminate locally stored password credentials where possible.
• Conduct periodic review of authentication and recovery workflows, and integrate application logs into the SOC with alerting for T1078 (Valid Accounts) activity.

References

• NVD — CVE-2026-102115: https://nvd.nist.gov/vuln/detail/CVE-2026-102115
• MITRE CWE-640 — Weak Password Recovery Mechanism for Forgotten Password: https://cwe.mitre.org/data/definitions/640.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Kiteworks Product Security / Vendor Advisories: https://www.kiteworks.com/ (monitor for a CVE-2026-102115 advisory)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not currently listed for this CVE)

No evidence of active exploitation, public PoC, or named threat actor campaigns targeting CVE-2026-102115 is present in the provided intelligence. EPSS has not yet scored this CVE.