CVE-2026-102095

Kiteworks Email Protection Gateway versions prior to 9.5.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The gateway performs server-side fetches of URLs contained within processed message content without sufficient destination restrictions. A remote, unauthenticated attacker can craft...

CVE-2026-102094 Kiteworks Email Protection Gateway unsafe reflection

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cau...

CVE-2026-102094 Kiteworks Email Protection Gateway unsafe reflection

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cau...

CVE-2026-102094

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection . The vulnerability exists because the mail-processing pipeline fails to sufficiently restrict code loaded from an imported rule configuration . An authenticated administrator with mail-rule configurati...

CVE-2026-102089 Kiteworks Email Protection Gateway path traversal

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CVE-2026-102089

The Kiteworks Email Protection Gateway (versions before 9.5.0) is vulnerable to a path traversal weakness within an administrative import function. This flaw allows an authenticated administrator to write files to arbitrary locations on the server, which could potentially be leveraged to achieve ...

CVE-2026-102089 Kiteworks Email Protection Gateway path traversal

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

PT-2026-103541

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...

PT-2026-103596

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...

PT-2026-103540

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...

CVE-2026-28272 Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability

Kiteworks is a private data network PDN. Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface...

CVE-2026-28272: Improper Neutralization of Input During Web Page Generation

Kiteworks is a private data network PDN. Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface...