accellion has 66 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 61 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 61. The median CVSS is 7.2 (high), with 9 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-306 (7) and CWE-918 (7). Most affected products: kiteworks (62), kiteworks_managed_file_transfer (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 61 prev 0
Products
- kiteworks 62
- kiteworks_managed_file_transfer 4
Worst active — by depth score
CVE-2026-102115Critical· 9.8Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow54CVE-2026-102149Critical· 9.4Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to52CVE-2026-102147Critical· 9.3A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affec…51CVE-2026-102106Critical· 9.1Improper authentication in a Kiteworks Email Protection Gateway administrative service50CVE-2026-102105Critical· 9.1Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF)50
accellion vulnerabilities
CVEs affecting accellion, newest first. Open any entry for full detail, references, and exploit status.
66 CVEsRSS
CVE-2026-102089High· 7.2Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This coul…
CVE-2025-53939Medium· 6.3Kiteworks is a private data network (PDN)
Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched i…
CVE-2025-53900Medium· 6.5Kiteworks MFT orchestrates end-to-end file transfer workflows
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for aut…
CVE-2025-53899High· 7.2Kiteworks MFT orchestrates end-to-end file transfer workflows
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administr…
CVE-2025-53897Medium· 6.8Kiteworks MFT orchestrates end-to-end file transfer workflows
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a spe…
CVE-2025-53896High· 7.1Kiteworks MFT orchestrates end-to-end file transfer workflows
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue …