CVE-2026-28270

Medium

Published: 27 February 2026

Published

27 February 2026

Modified

04 March 2026

KEV Added

—

Patch

—

CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS Score 0.0002 4.0th percentile

Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-28270 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Accellion Kiteworks. Its CVSS base score is 4.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).

Deeper analysis

CVE-2026-28270 is an unrestricted upload of files with dangerous type vulnerability (CWE-434) affecting Kiteworks, a private data network (PDN), in versions prior to 9.2.0. The issue stems from inadequate validation in the Kiteworks configuration, enabling the upload of arbitrary files without proper checks on file types. It has a CVSS v3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), indicating medium severity primarily due to high integrity impact.

Malicious administrators with high privileges (PR:H) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows attackers to upload unauthorized file types to the system, potentially compromising data integrity by introducing malicious or unintended content.

The Kiteworks security advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45 details the patch in version 9.2.0, which addresses the configuration flaw and prevents arbitrary file uploads. Security practitioners should upgrade to Kiteworks 9.2.0 or later to mitigate the risk.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9065

Vulnerability details

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains…

a patch for the issue.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Unrestricted dangerous file upload (CWE-434) by privileged admins directly enables planting web shells on the public-facing Kiteworks server (T1505.003) and is exploited as part of attacking the exposed application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1