CriticalRansomware
Kiteworks Patches 126 Vulnerabilities in Massive Security Update
Cyber Security News·Source published ·1 min read
What happened?
Kiteworks has released a major security update that addresses 126 vulnerabilities across its secure data transfer platform and associated applications. The update includes fixes for critical account takeover flaws, high-severity code execution bugs, security bypass issues, unauthorized data modification, privilege escalation, and denial-of-service conditions. The company published the vulnerabilities through its public security advisories repository, which provides affected-version details and
Key details
- Kiteworks released a major update fixing 126 vulnerabilities across its platform and applications.
- Critical account takeover flaws affect Kiteworks Core and Email Protection Gateway before version 9.5.1.
- Arbitrary code execution vulnerability exists in Kiteworks Core before 9.5.1.
- Privilege escalation issue found in Kiteworks Core before 9.5.1.
- Unauthorized file modification flaws affect Email Protection Gateway before 9.5.1.
- Secure Data Forms before 9.5.0 has high-severity unauthorized data modification flaw.
- Secure Data Forms before 9.5.1 has separate high-severity security bypass issue.
Affected
- Kiteworks Core versions before 9.5.1
- Kiteworks Email Protection Gateway versions before 9.5.1
- Kiteworks Secure Data Forms versions before 9.5.0
- Kiteworks Secure Data Forms versions before 9.5.1
Fixes and mitigations
- Upgrade affected deployments to version 9.5.1 or later where applicable.
- Obtain product-specific remediation information through release notes distributed with each update.
What to look for
- Review account activity for suspicious access.
- Assess whether internet-facing instances were reachable before patching.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.