CVE-2026-102124

Executive Summary

CVE-2026-102124 is a missing-authentication vulnerability (CWE-306) in a Kiteworks appliance setup interface that continues to expose a limited set of setup records after initial configuration has completed. An unauthenticated attacker with network access to the appliance can read and modify configuration records including a captured contact name and email address. The issue carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is currently unpatched, with no public proof-of-concept, exploit code, Nuclei template, or CISA KEV listing.

Technical Analysis

The flaw is a classic instance of CWE-306 (Missing Authentication for Critical Function). According to the NVD description, the Kiteworks appliance setup interface does not enforce authentication once the appliance has completed its initial configuration. The expected security model for such setup interfaces is that they are reachable only during an unaudited bootstrap window and should either be disabled, bound to internal interfaces, or gated behind authentication after commissioning. Here, that state transition — from "unconfigured setup mode" to "operational mode" — does not close the access path. The setup endpoint remains network-reachable and processes requests without validating an authenticated session.

The exposed data set is explicitly described as "a limited set of setup records, including a contact name and email address captured during initial configuration." Critically, the weakness is not read-only: the description states an attacker "could read and modify" these records. This is therefore a combined confidentiality and integrity issue, which is reflected in the CVSS subscores. Confidentiality is rated Low (C:L) because only a constrained set of setup records is exposed rather than the full configuration store or credential material. Integrity is also rated Low (I:L) because modification is scoped to those same setup records rather than to authentication, cryptographic, or system-level settings. Availability is Not Impacted (A:N) — no denial-of-service or destructive primitive is described. The vector AV:N/AC:L/PR:N/UI:N confirms the attack is remotely reachable, requires no privileges, requires no user interaction, and has low attack complexity, which is what elevates an otherwise limited-impact flaw to a meaningful 6.5 base score.

The attack surface is the appliance's network-facing setup/management interface. Because no affected version range, product build, or deployment topology is published, the exact population of exposed appliances cannot be enumerated from the available data. No technical detail is available on the request method, parameter names, endpoint path, or the storage backend for the setup records; those specifics are not present in the NVD description and are not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authentication on a residual setup interface). No specific endpoint paths, parameter names, or function names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet-facing Kiteworks appliances using certificate transparency, banner grabbing, or search-engine queries against the appliance's default login/setup page title. Because the vulnerable interface is described as a setup interface, the assessor's goal is to identify appliances that have completed commissioning but still expose the setup surface.

2. Triggering the flaw class. The attacker sends unauthenticated HTTP requests directly to the setup interface. The vulnerability class is missing authentication for a critical function: no session token, no credential, and no pre-shared setup key is required for the endpoint to process the request. The appliance does not verify that initial configuration is already complete before honoring the request.

3. Payload / execution method (class level). With no authentication gate, the attacker issues a read request to retrieve the setup records and — per the NVD description — an additional request to modify them. At the vulnerability-class level this is straightforward unauthenticated data access and update against a residual management surface; no memory-corruption, deserialization, or injection primitive is described.

4. Post-exploitation impact. The attacker obtains the contact name and email address captured at commissioning and can alter those records. By itself this is low-severity data. However, a modified administrator contact record on a security appliance is a plausible social-engineering and account-recovery pivot: altered contact data can misdirect notifications, enable password-reset flows routed to an attacker-controlled mailbox, or support pretexting against the appliance owner. The secondary risk is reconnaissance value — confirming the appliance model and configuration state for follow-on exploitation.

Impact Assessment

Business impact is moderate but not catastrophic, consistent with the CVSS subscores. Confidentiality (C:L) is limited to setup records, primarily a contact name and email address; no credential, key, or bulk data exposure is described. Integrity (I:L) is limited to modification of those same records. Availability (A:N) is unaffected.

Affected systems are Kiteworks appliances that have completed initial configuration but still expose the setup interface to the network. Blast radius is bounded by that exposure: appliances behind strict network segmentation or a management VPN are not remotely reachable and therefore not directly at risk. Internet-exposed appliances are the primary concern given AV:N and PR:N. The low attack complexity (AC:L) and absence of user interaction (UI:N) mean exploitation is repeatable and automatable once a target set is identified, even though the per-target data yield is small. No CISA KEV listing and no EPSS score (not yet scored by FIRST.org) are available to refine real-world risk; the score should not be fabricated or assumed.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to Kiteworks Setup Interface Records
id: 3f9c1a72-5b7e-4d21-9c88-0a1f2e7b6d10
status: experimental
description: Detects unauthenticated or post-setup access to the Kiteworks appliance setup interface consistent with CVE-2026-102124 (CWE-306).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102124
author: Threat Intelligence
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/setup'
      - '/setup/'
      - '/setup/contact'
  selection_nosession:
    cs-Cookie|contains: 'session'
    cs-Cookie: null
  selection_status:
    sc-status:
      - 200
      - 302
  condition: selection_path and selection_status and selection_nosession
falsepositives:
  - Legitimate initial commissioning by administrators
  - Health checks probing the setup endpoint
level: medium

YARA Rule

rule CVE_2026_102124_Kiteworks_Setup_NoAuth
{
    meta:
        description = "Detects HTTP traffic referencing the Kiteworks setup interface associated with CVE-2026-102124"
        cve = "CVE-2026-102124"
        cwe = "CWE-306"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $a = "/setup" ascii nocase
        $b = "Kiteworks" ascii nocase
        $c = "setup.contact" ascii nocase
        $d = "setup record" ascii nocase
    condition:
        ($b and ($a or $c or $d))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102124 Kiteworks Unauthenticated Setup Interface Access"; flow:established,to_server; http.uri; content:"/setup"; nocase; http.method; content:"GET"; http.header; content:"Cookie"; negate; pcre:"/\/setup(\/|$)/i"; classtype:attempted-recon; reference:cve,2026-102124; sid:2026102124; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and http.request.uri like "/setup*" and not exists(http.request.headers.cookie)]
  [network where http.response.status_code == 200 and url.path like "/setup*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "(?i)^/setup(/|$)")
| eval authenticated=if(isnull(cookie) OR cookie="", "no", "yes")
| where authenticated="no"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri_path status
| where count > 0
| table src_ip uri_path status count first_seen last_seen

Wazuh OSSEC Rule

<group name="web,kiteworks,attack">
  <rule id="202610" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/setup</url>
    <regex>CVE-2026-102124</regex>
    <description>Kiteworks: unauthenticated access to setup interface (CVE-2026-102124)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to the appliance setup interface. Place the management/setup surface behind a VPN, an internal-only management VLAN, or a firewall allow-list so that AV:N reachability is eliminated. Where the setup port cannot be segmented, disable the setup interface after commissioning if the appliance exposes a toggle for it, and verify the configuration state via an authenticated management session. Because the source data does not specify the interface port or path, hardening must be validated directly against each deployed appliance's documented administration surface rather than assumed.

2. Patch / upgrade steps. No vendor advisory, fixed version, or patch reference is available from any tracked source. Do not assume a fixed build exists. Track the Kiteworks vendor security advisory page and the NVD entry (CVE-2026-102124) for an update, and subscribe to Kiteworks notification channels so that patch availability is detected promptly. Until a fix is published, treat remediation as network-control based.

3. Long-term hardening. Ensure that commissioning workflows explicitly close the setup surface once initial configuration completes, and require authenticated access to any residual setup records. Enforce least-privilege network segmentation for all appliance management planes, apply egress and ingress filtering, and monitor the setup interface for unexpected post-commissioning requests. Retain the contact records — name and email — under integrity review so unauthorized modification can be detected and rolled back.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-102124
• CWE-306 (Missing Authentication for Critical Function): https://cwe.mitre.org/data/definitions/306.html
• CISA KEV catalog: not listed for this CVE as of this report
• FIRST.org EPSS: not yet scored for this CVE
• Kiteworks vendor security advisories: no advisory identified in the provided data; consult the vendor's official security channel directly
• No public PoC, exploit code, or Nuclei template is available; no in-the-wild exploitation or named threat-actor campaign is identified in the source data