CVE-2026-102116 Kiteworks Email Protection Gateway Path Traversal

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account...

CVE-2026-102119 Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

CVE-2026-102119

A path traversal weakness exists in an optional, non-default administrative feature of the Kiteworks Email Protection Gateway . This flaw allows an authenticated administrator to move files to unintended locations outside the designated directory, which could potentially lead to arbitrary code ex...

CVE-2026-102130

The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...

EUVD-2026-90287

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...

EUVD-2026-90286

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and...

CVE-2026-102131 Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and...

CVE-2026-102131

The Kiteworks Email Protection Gateway is vulnerable to an issue where it fails to properly handle case sensitivity during configuration validation. While the gateway rejects certain settings, its validation mechanism does not recognize every possible form in which these settings can be supplied....

EUVD-2026-90278

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...

CVE-2026-102137

In Kiteworks Core , an authenticated administrator can bypass content validation during an administrative file upload. This allows for the storage of files containing dangerous content on the appliance. While this vulnerability enables the storage of malicious files, it does not directly result i...

EUVD-2026-90274

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...

CVE-2026-102145 Kiteworks Core Server-Side Request Forgery through CRLF Injection

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

EUVD-2026-90381

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

CVE-2026-102145

An authenticated administrator can exploit a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Core caused by CRLF Injection . This flaw allows the server to issue requests to and interact with internal network services that are intended to be unreachable through the web interface. Wh...

CVE-2026-102145 Kiteworks Core Server-Side Request Forgery through CRLF Injection

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

CVE-2026-102097 Kiteworks Email Protection Gateway remote code execution

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could...

EUVD-2026-90380

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could...

CVE-2026-102097 Kiteworks Email Protection Gateway remote code execution

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could...

CVE-2026-102096 Kiteworks Core OS command injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102094

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection . The vulnerability exists because the mail-processing pipeline fails to sufficiently restrict code loaded from an imported rule configuration . An authenticated administrator with mail-rule configurati...