Kiteworks Email Protection Gateway vulnerabilities

CVE-2026-102106 [CRITICAL] CWE-287 CVE-2026-102106: Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administr Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, mod

CVE-2026-102149 [CRITICAL] CWE-306 CVE-2026-102149: Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could b Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting

CVE-2026-102105 [CRITICAL] CWE-918 CVE-2026-102105: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. T

CVE-2026-102095 [CRITICAL] CWE-918 CVE-2026-102095: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the

CVE-2026-102102 [CRITICAL] CWE-918 CVE-2026-102102: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. T

CVE-2026-102103 [CRITICAL] CWE-918 CVE-2026-102103: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. T

CVE-2026-102104 [CRITICAL] CWE-918 CVE-2026-102104: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. T

CVE-2026-102097 [HIGH] CWE-22 CVE-2026-102097: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kite Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the a

CVE-2026-102143 [HIGH] CWE-306 CVE-2026-102143: An unauthenticated attacker could cause a file with attacker-controlled content to be written to the An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.

CVE-2026-102089 [HIGH] CWE-22 CVE-2026-102089: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness i Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2026-102108 [HIGH] CWE-502 CVE-2026-102108: An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serializ An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a spec

CVE-2026-102119 [HIGH] CWE-22 CVE-2026-102119: A path traversal weakness in an optional, non-default administrative feature allowed an authenticate A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2026-102116 [HIGH] CWE-22 CVE-2026-102116: -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account.

CVE-2026-102130 [HIGH] CWE-94 CVE-2026-102130: Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.

CVE-2026-102131 [HIGH] CWE-94 CVE-2026-102131: Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did n Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service

CVE-2026-102094 [HIGH] CWE-470 CVE-2026-102094: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the appr

CVE-2026-102128 [HIGH] CWE-287 CVE-2026-102128: An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act o An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtain control of a platform account

CVE-2026-102127 [HIGH] CWE-611 CVE-2026-102127: An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and crede

CVE-2026-102146 [MEDIUM] CWE-73 CVE-2026-102146: An authenticated Email Protection Gateway administrator holding only limited, delegated permissions An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration o

CVE-2026-102135 [MEDIUM] CWE-502 CVE-2026-102135: On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted b On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of