CVE-2026-28272:
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.
Score
A numerical rating that indicates how dangerous this vulnerability is.
4.8Medium- Published Date:Feb 27, 2026
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.0
- EPSS Percentile:9%
Exploitability
- Score:1.7
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:HIGH
- User Interaction:REQUIRED
- Scope:CHANGED
Impact
- Score:2.7
- Confidentiality Impact:LOW
- Integrity Impact:LOW
- Availability Impact:NONE
Description Preview
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
