CVE-2026-28270

Medium

Published: 27 February 2026

Published

27 February 2026

Modified

04 March 2026

KEV Added

—

Patch

—

CVSS Score 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS Score 0.0002 3.9th percentile

Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-28270 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Accellion Kiteworks. Its CVSS base score is 4.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

MP-7 Media Use

addresses: CWE-434

Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.

SC-44 Detonation Chambers

addresses: CWE-434

Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.

SC-51 Hardware-based Protection

addresses: CWE-434

Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.

SI-3 Malicious Code Protection

addresses: CWE-434

Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Unrestricted dangerous file upload (CWE-434) by privileged admins directly enables planting web shells on the public-facing Kiteworks server (T1505.003) and is exploited as part of attacking the exposed application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains…

a patch for the issue.

Deeper analysisAI

CVE-2026-28270 is an unrestricted upload of files with dangerous type vulnerability (CWE-434) affecting Kiteworks, a private data network (PDN), in versions prior to 9.2.0. The issue stems from inadequate validation in the Kiteworks configuration, enabling the upload of arbitrary files without proper checks on file types. It has a CVSS v3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), indicating medium severity primarily due to high integrity impact.

Malicious administrators with high privileges (PR:H) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows attackers to upload unauthorized file types to the system, potentially compromising data integrity by introducing malicious or unintended content.

The Kiteworks security advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45 details the patch in version 9.2.0, which addresses the configuration flaw and prevents arbitrary file uploads. Security practitioners should upgrade to Kiteworks 9.2.0 or later to mitigate the risk.