CVE-2025-53899highCWE-941

CVE-2025-53899: fallo de gravedad alta en kiteworks security-advisories

Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear security-advisories

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 1.0%
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
kiteworks · security-advisories
CVEs relacionadas — kiteworks security-advisories

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-28269MEDIUMKiteworks Core has an OS Command InjectionEPSS 2.2%CVE-2026-28270MEDIUMKiteworks Core has an Unrestricted Upload of File with Dangerous TypeEPSS 1.8%CVE-2025-53900MEDIUMKiteworks MFT has a Privilege Defined With Unsafe ActionsEPSS 1.2%CVE-2025-53939MEDIUMKiteworks Core is vulnerable to Improper Input ValidationEPSS 0.8%CVE-2026-28271MEDIUMKiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.5%CVE-2026-28272HIGHKiteworks Email Protection Gateway has a Cross-site Scripting vulnerabilityEPSS 0.4%