CVE-2026-24752: Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Synopsis

A reflected cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms, affecting all versions prior to 9.3.0. The vulnerability is reachable over the network with no authentication required, but a victim must be tricked into clicking a crafted link for the attack to succeed. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions taken on the victim's behalf. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser session by delivering a crafted URL over the network, making the service's public or internal network exposure the entry point.

• AuthenticationNot required

  No account or credentials are needed; the attacker operates entirely as an unauthenticated external party.

• Victim interactionRequired

  The attack succeeds only if a logged-in user clicks or follows a malicious link crafted by the attacker, making social engineering a necessary step.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors required beyond delivering the malicious link to the victim.

Blast Radius

• Reads session tokens or authentication cookies from the victim's active browser session, enabling account takeover without further credential phishing.
• Reads sensitive data displayed within Kiteworks Secure Data Forms pages that the victim has access to, including any private data visible in the current session context.
• Performs actions inside the Kiteworks application on behalf of the victim, such as submitting or modifying form data, by injecting JavaScript that issues requests using the victim's authenticated session.