{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T13:26:16.635969Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T13:37:07.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Core",
          "vendor": "Kiteworks",
          "versions": [
            {
              "lessThan": "9.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "9.5.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Supr4s, https://yeswehack.com/hunters/Supr4s"
        },
        {
          "lang": "en",
          "value": "wlayzz, https://yeswehack.com/hunters/wlayzz"
        },
        {
          "lang": "en",
          "value": "Icare, https://yeswehack.com/hunters/icare"
        },
        {
          "lang": "en",
          "value": "truff, https://yeswehack.com/hunters/truff"
        }
      ],
      "datePublic": "2026-09-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file\u0027s header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T20:11:07.754Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw"
        },
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json"
        }
      ],
      "title": "Kiteworks Core Insufficient Verification of Data Authenticity",
      "x_generator": {
        "engine": "VINCE-NT 1.15.0+build.145"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-102140",
    "datePublished": "2026-09-30T20:11:07.754Z",
    "dateReserved": "2026-09-28T17:39:13.564Z",
    "dateUpdated": "2026-10-01T13:37:07.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-102140\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T13:26:16.635969Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-01T13:32:21.413Z\"}}], \"cna\": {\"title\": \"Kiteworks Core Insufficient Verification of Data Authenticity\", \"credits\": [{\"lang\": \"en\", \"value\": \"Supr4s, https://yeswehack.com/hunters/Supr4s\"}, {\"lang\": \"en\", \"value\": \"wlayzz, https://yeswehack.com/hunters/wlayzz\"}, {\"lang\": \"en\", \"value\": \"Icare, https://yeswehack.com/hunters/icare\"}, {\"lang\": \"en\", \"value\": \"truff, https://yeswehack.com/hunters/truff\"}], \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Kiteworks\", \"product\": \"Core\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"9.5.1\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"9.5.1\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-09-30T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw\", \"name\": \"url\"}, {\"url\": \"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json\", \"name\": \"url\"}], \"x_generator\": {\"engine\": \"VINCE-NT 1.15.0+build.145\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file\u0027s header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-345\", \"description\": \"CWE-345 Insufficient Verification of Data Authenticity\"}]}], \"providerMetadata\": {\"orgId\": \"9119a7d8-5eab-497f-8521-727c672e3725\", \"shortName\": \"cisa-cg\", \"dateUpdated\": \"2026-09-30T20:11:07.754Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-102140\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-01T13:37:07.652Z\", \"dateReserved\": \"2026-09-28T17:39:13.564Z\", \"assignerOrgId\": \"9119a7d8-5eab-497f-8521-727c672e3725\", \"datePublished\": \"2026-09-30T20:11:07.754Z\", \"assignerShortName\": \"cisa-cg\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}