CVE-2026-24750 Overview
CVE-2026-24750 is a stored Cross-Site Scripting (XSS) vulnerability in Kiteworks Secure Data Forms. Kiteworks is a private data network (PDN) used for secure file sharing and form-based data collection. The flaw exists in versions prior to 9.2.1 and is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. An authenticated attacker can inject malicious script content when modifying forms. The injected payload executes in the browser context of other users who view the affected form.
Critical Impact
An authenticated attacker can persist malicious JavaScript inside Kiteworks forms, enabling session theft, phishing redirection, and unauthorized actions against form viewers.
Affected Products
- Accellion Kiteworks Secure Data Forms prior to version 9.2.1
- Kiteworks Private Data Network deployments using Secure Data Forms
- All Kiteworks installations exposing form modification functionality to authenticated users
Discovery Timeline
- 2026-03-25 - CVE-2026-24750 published to NVD
- 2026-03-27 - Last updated in NVD database
Technical Details for CVE-2026-24750
Vulnerability Analysis
The vulnerability resides in the form modification workflow of Kiteworks Secure Data Forms. The application fails to neutralize user-supplied input before embedding it into rendered web pages. An attacker with authenticated access and form modification privileges can inject HTML or JavaScript payloads into form fields. When another user accesses the modified form, the browser executes the stored script in the victim's session context.
The scope change indicated by the CVSS vector reflects that an attacker compromising one component can affect resources beyond its security authority. Exploitation requires user interaction, since a victim must load the form, and confidentiality and integrity impacts are limited to data accessible within the browser session.
Root Cause
The root cause is improper output encoding when rendering form content. Input submitted during form modification is stored without sanitization. The rendering layer then serves this data to other authenticated users without contextual escaping. This pattern matches the classic stored XSS condition described in CWE-79.
Attack Vector
An attacker first authenticates to Kiteworks with privileges sufficient to modify a Secure Data Form. The attacker inserts a script payload into a form field that accepts free-text input. The payload is persisted server-side and delivered when victims open the form. Victim interaction triggers code execution in the user's browser, allowing the attacker to steal session tokens, perform actions on behalf of the victim, or pivot to other authenticated functionality.
No verified proof-of-concept code is publicly available. See the Kiteworks Security Advisory GHSA-rfwm-2hq6-h84g for vendor-provided technical detail.
Detection Methods for CVE-2026-24750
Indicators of Compromise
- Form field values containing <script>, javascript:, onerror=, or onload= event handlers stored in Kiteworks form definitions
- Unusual outbound browser requests from authenticated Kiteworks user sessions to attacker-controlled domains
- Audit log entries showing form modifications by accounts that do not normally edit forms
- Browser console errors or content security policy violations originating from Kiteworks form pages
Detection Strategies
- Review Kiteworks audit logs for form modification events and correlate against expected administrative activity
- Inspect stored form definitions in the Kiteworks database for HTML tags or JavaScript syntax in fields that should contain plain text
- Monitor web proxy and DLP telemetry for unexpected data exfiltration from sessions accessing Kiteworks form URLs
- Apply content security policy (CSP) report-only monitoring to surface inline script execution on Kiteworks pages
Monitoring Recommendations
- Alert on authenticated Kiteworks sessions making outbound requests to newly registered or low-reputation domains
- Track form creation and modification rates per user to identify anomalous bursts of activity
- Enable verbose logging on the Kiteworks web tier and forward to a SIEM for retention and correlation
How to Mitigate CVE-2026-24750
Immediate Actions Required
- Upgrade Kiteworks to version 9.2.1 or later, which contains the vendor patch for this vulnerability
- Audit all existing Secure Data Forms for unexpected HTML or script content prior to applying the upgrade
- Review user accounts with form modification privileges and remove unnecessary access
- Rotate session tokens and credentials for users who may have accessed compromised forms
Patch Information
Kiteworks has released version 9.2.1 to remediate CVE-2026-24750. Administrators should follow vendor upgrade guidance documented in GHSA-rfwm-2hq6-h84g. No supported workaround replaces the patch, since the vulnerability requires server-side input neutralization.
Workarounds
- Restrict form modification permissions to a minimal set of trusted administrative users until the patch is applied
- Enforce a strict Content Security Policy on Kiteworks-facing reverse proxies to limit inline script execution
- Disable or quarantine non-essential Secure Data Forms during the remediation window
# Verify installed Kiteworks version meets the patched baseline
kiteworks-cli system version --check-min 9.2.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
