CVE-2026-102150

Executive Summary

CVE-2026-102150 is an unauthenticated access control flaw (CWE-306, Missing Authentication for Critical Function) in the Kiteworks Advanced Forms component, where an internal function was reachable without authentication and could be invoked by an unauthenticated attacker to perform a limited set of internal service operations on the Kiteworks platform. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting a network-reachable, unauthenticated, low-complexity attack with scope change but limited confidentiality and integrity impact. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the flaw is unpatched according to all tracked sources.

Technical Analysis

The root weakness is CWE-306, "Missing Authentication for Critical Function." According to the NVD description, a function within the Kiteworks Advanced Forms component was reachable without authentication. Because this function was not protected by an authentication check, an unauthenticated remote attacker could invoke it directly over the network. When invoked, the function allowed the attacker to carry out a "limited set of internal service operations" on the Kiteworks platform.

Several technical points are explicitly documented and must be treated as the scope boundary of this vulnerability:

• The exposure is in the Kiteworks Advanced Forms component, a feature area of the Kiteworks platform.
• The vulnerable function is reachable pre-authentication — there is no credential or session requirement to reach the code path.
• The impact is bounded. Per the description, the attacker "did not permit access to user accounts, stored files, or form submissions." This means the flaw does not directly yield account takeover, file exfiltration, or exposure of submitted form data.

The CVSS vector is consistent with this bounded impact: Confidentiality (C:L) and Integrity (I:L) are both Low, and Availability (A:N) is None. The scope value is Changed (S:C), indicating that successfully exploiting this function can affect resources beyond the security authority of the vulnerable component — here, the internal service operations the function can trigger.

The NVD description does not disclose the function name, the URL path, the protocol, the exact internal service operations that can be reached, or the parameters used. No CNA title was provided and no affected version range was published. Analyst guidance: do not assume a specific endpoint or parameter name — these are not derivable from the available data. What can be stated with confidence is the vulnerability class: an authentication bypass / missing-authentication condition on a server-side function in a public-facing enterprise content collaboration product. In practice, such functions are typically invoked through the platform's HTTP(S) interface, but the description does not confirm the transport or route, and this report does not speculate beyond the class of flaw.

The absence of a published affected-version range and the presence of vendor-side patching (0/4 patch confidence) means defenders should treat all deployed Kiteworks instances exposing the Advanced Forms component as potentially affected until the vendor's own advisories are reconciled against the deployment.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-102150, and no Nuclei template has been published. The attack chain below is therefore described at the vulnerability-class level and is inferred from the NVD description; it does not assert specific function names, endpoints, or parameters that are not present in the source data.

1. Reconnaissance / target identification. An attacker identifies internet-facing Kiteworks deployments. This is a standard external footprinting step: search engines indexed on Kiteworks page titles and content, certificate metadata, and service-response banners can be used to enumerate exposed instances. The Advanced Forms component must be present and reachable for the function to be invoked.

2. Triggering the flaw class. The attacker sends a request to the unauthenticated function in the Advanced Forms component. Because no authentication check guards this code path (CWE-306), the request does not require a session token, credential, or login. The attacker does not need an account on the platform.

3. Execution at the vulnerability-class level. Once the function is reached, the attacker can direct it to perform a limited set of internal service operations. The description does not identify which internal operations are exposed, so this report does not enumerate them. The defining characteristic of the exploit is the absence of an authorization gate, not a memory corruption or injection payload.

4. Post-exploitation impact. The documented boundary applies: user accounts, stored files, and form submissions are explicitly not accessible via this path. The attacker's reachable impact is therefore confined to whatever internal service operations the function enables, consistent with the Low confidentiality and Low integrity ratings and the scope-change condition in the CVSS vector. Availability is unaffected (A:N).

Because there is no observed exploitation in the wild and no public tooling, the described chain should be treated as an inferred, class-level model rather than a validated attack sequence.

Impact Assessment

Business impact is bounded but non-trivial. The CVSS v3.1 base score is 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N:

• Attack Vector: Network (AV:N) — exploitable remotely over the network.
• Attack Complexity: Low (AC:L) — no special conditions or race windows are described.
• Privileges Required: None (PR:N) — fully unauthenticated.
• User Interaction: None (UI:N) — no victim action is required.
• Scope: Changed (S:C) — the function can affect resources beyond its own security authority, i.e., internal service operations.
• Confidentiality: Low (C:L) — limited information exposure; user accounts and stored files are explicitly out of reach.
• Integrity: Low (I:L) — limited ability to alter or drive internal service operations.
• Availability: None (A:N) — no denial-of-service impact documented.

Affected systems: Kiteworks deployments that expose the Advanced Forms component. Because no affected version range has been published, the blast radius across a given estate cannot be narrowed by version — inventory must be driven by component presence.

Blast radius considerations: the scope-change condition means impact is not strictly contained to the Advanced Forms component itself; the reachable internal service operations are the concern. However, the explicit exclusions in the description (no user account access, no stored file access, no form submission access) meaningfully cap the worst-case outcome as documented. The primary business risk is unauthorized invocation of internal platform operations by an unauthenticated remote party, plus the compliance and audit implications of an unauthenticated control gap in an enterprise content collaboration platform. This vulnerability is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Kiteworks Advanced Forms Unauthenticated Function Access (CVE-2026-102150)
id: 8f1c2a44-5b3e-4d9a-9c7e-1a2b3c4d5e6f
status: experimental
description: Detects unauthenticated requests to the Kiteworks Advanced Forms component consistent with CWE-306 missing authentication for a critical function.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102150
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: kiteworks
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/advanced-forms'
      - '/advancedforms'
  selection_status:
    sc-status:
      - 200
      - 204
  selection_noauth:
    cs-username: ''
  condition: selection_path and selection_status and selection_noauth
fields:
  - c-ip
  - cs-uri-stem
  - cs-username
  - sc-status
falsepositives:
  - Legitimate anonymous access to non-sensitive Advanced Forms endpoints, if any are designed to be public.
level: high
tags:
  - attack.t1190
  - cve.2026.102150

YARA Rule

rule CVE_2026_102150_Kiteworks_AdvancedForms_Unauth
{
    meta:
        description = "Detects references to unauthenticated Advanced Forms function access in Kiteworks (CVE-2026-102150, CWE-306)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102150"
        date = "2026-01-01"
        severity = "high"

    strings:
        $kw1 = "Kiteworks" ascii nocase
        $af1 = "Advanced Forms" ascii nocase
        $af2 = "AdvancedForms" ascii nocase
        $cwe = "CWE-306" ascii nocase

    condition:
        uint16(0) == 0x5A4D or
        (any of ($af*) and $kw1) or
        ($cwe and $af1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102150 Kiteworks Advanced Forms Unauthenticated Function Access Attempt"; flow:established,to_server; http.uri; content:"advanced"; nocase; http.uri; content:"form"; nocase; distance:0; http.header; content:"Authorization"; negate; nocase; reference:cve,2026-102150; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102150; classtype:attempted-admin; sid:2026102150; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      url.path : "*advanced*form*" and
      http.request.method : ("GET", "POST") and
      not http.request.headers : "*Authorization*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=kiteworks:web
| eval uri=lower(uri)
| where (match(uri, "advanced.?forms") OR match(uri, "advancedform"))
| where isnull(user) OR user="" OR user="-" OR user="anonymous"
| where status IN (200, 204)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,web,cve-2026-102150,">
  <rule id="2026150" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>advanced</match>
    <regex type="pcre2">(?i)advanced.?forms.*\s(200|204)\s</regex>
    <description>CVE-2026-102150: Possible unauthenticated access to Kiteworks Advanced Forms function</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102150,authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Treat all internet-facing Kiteworks deployments that expose the Advanced Forms component as potentially affected until the vendor's position is reconciled with your inventory.
• Where operationally feasible, restrict network access to Kiteworks deployments to trusted source ranges (VPN, zero-trust proxy, allowlisted IPs) to reduce the unauthenticated attack surface. Note that AV:N means any reachable path counts.
• If the Advanced Forms component is not required, disable or block it. Where a reverse proxy or WAF fronts the deployment, apply request filtering to the component's routes as a compensating control.
• Increase logging and alerting on unauthenticated requests to the Advanced Forms component and on access to internal service operations (see Detection Guidance).
• Do not rely on the bounded-impact description as a reason to deprioritize: the underlying defect is a missing authentication control on a network-reachable function, and the scope-change rating indicates impact can extend past the component.

2. Patch / upgrade steps

• No vendor fix has been identified in any tracked source. No affected version range has been published, so version-based targeting is not possible at this time.
• Monitor the Kiteworks security advisory channel directly and apply vendor guidance the moment it is published. Until a patched release exists, there is nothing to patch to — confirm with the vendor whether any interim guidance applies to your deployment.
• Maintain a current inventory of Kiteworks instances and confirm exposure of the Advanced Forms component per instance to enable fast remediation once a fix ships.

3. Long-term hardening

• Enforce authentication and authorization checks on every server-side function, including internal or "service" functions, as a standard secure-design requirement (remediates CWE-306 class defects).
• Adopt a default-deny posture for unauthenticated code paths in public-facing enterprise collaboration software.
• Integrate component-level software bill of materials (SBOM) tracking so exposure can be assessed by component, not only by version.
• Establish a recurring process to reconcile vendor advisories against deployed instances and to validate compensating controls with periodic testing.

References

• National Vulnerability Database — CVE-2026-102150: https://nvd.nist.gov/vuln/detail/CVE-2026-102150
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — no score available for this CVE (not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-102150 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public proof-of-concept, exploit code, or Nuclei template have been identified for CVE-2026-102150 at the time of writing.