CVE-2026-28269 Kiteworks Core has an OS Command Injection
Authenticated users can exploit command execution flaws to overwrite system files and gain elevated access in Kiteworks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28269?
CVE-2026-28269 is a medium-severity command injection vulnerability in Accellion Kiteworks, published on 26 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
Weakness: CWE-78
Which versions are affected by CVE-2026-28269?
It affects 1 product.
Products include Accellion Kiteworks.
How do I fix CVE-2026-28269?
No fix has been published for CVE-2026-28269 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-28269 being exploited?
There is no known exploitation of CVE-2026-28269 in the wild and no public exploit code.
Other vulnerabilities in Accellion Kiteworks
- CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow
- CVE-2026-102149 Kiteworks Email Protection Gateway Improper Access Control
- CVE-2026-102147 Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
- CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery
- CVE-2026-102102 Kiteworks Email Protection Gateway server-side request forgery