CVE-2026-102119

A path traversal weakness exists in an optional, non-default administrative feature of the Kiteworks Email Protection Gateway . This flaw allows an authenticated administrator to move files to unintended locations outside the designated directory, which could potentially lead to arbitrary code ex...

CVE-2026-102119 Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

CVE-2026-102104

Kiteworks Email Protection Gateway versions prior to 9.5.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw occurs during an online certificate status check for inbound messages, which can be triggered by a remote, unauthenticated attacker. This vulnerability allows the gateway t...

CVE-2026-102104 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

EUVD-2026-90297

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102104 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

EUVD-2026-90294

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102103

Kiteworks Email Protection Gateway versions before 9.5.0 are vulnerable to a Server-Side Request Forgery (SSRF) . This weakness occurs when the gateway retrieves a certificate revocation list from an inbound message, allowing a remote, unauthenticated attacker to induce the gateway to issue craft...

CVE-2026-102103 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102103 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102127 Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

EUVD-2026-90290

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

CVE-2026-102127 Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

CVE-2026-102127

The Kiteworks Email Protection Gateway is vulnerable to an XML External Entity (XXE) injection due to an XML parser that does not restrict external entity references. If an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could submit a crafted mess...

CVE-2026-102128 Kiteworks Email Protection Gateway Improper Authentication

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentiall...

EUVD-2026-90289

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentiall...

CVE-2026-102128 Kiteworks Email Protection Gateway Improper Authentication

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentiall...

CVE-2026-102128

The Kiteworks Email Protection Gateway contains an identity-verification weakness that allows the gateway to act on the Kiteworks platform on behalf of unauthenticated users. An attacker can exploit this to provision a platform account for an unknown identity, potentially leading to the unauthori...

CVE-2026-102130 Kiteworks Email Protection Gateway Remote Code Execution

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...

CVE-2026-102130

The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...