Vulnerability in Kiteworks Email Protection Gateway

CVE-2026-102146

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (39.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-102146?
CVE-2026-102146 is a medium-severity vulnerability in Kiteworks Email Protection Gateway, classified under External Control of File Name or Path. CVSS score: 6.5/10. Published 2026-09-30.
How severe is CVE-2026-102146?
Medium severity. CVSS v3 base score is 6.5 out of 10.