CVE-2026-28272 - Vulnerability Analysis

Overview

Kiteworks < 9.2.0 contains a stored XSS caused by malicious script injection via a configuration interface, letting authenticated administrators execute scripts when users interact with the interface, exploit requires admin authentication.

Severity & Score

Impact

Authenticated administrators can execute malicious scripts, potentially compromising user sessions or data.

Mitigation

Update to version 9.2.0 or later.

References

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-7hxj-ch78-xqgr

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🟠 CVE-2026-28272 - High (8.1) Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28272/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner