CVE-2026-102135: On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that…

PriorityP340medium6.6CVSS 3.1

AVNACHPRHUINSUCHIHAH

EPSS

0.41%

33.7th percentile

On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kiteworks	email_protection_gateway	< 9.5.1	9.5.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.