Kiteworks Email Protection Gateway
21 CVEs affecting Kiteworks Email Protection Gateway. Latest disclosed: 2026-09-30. Critical: 7, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102149 | Critical | 9.4 | 2026-09-30 | Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a… |
CVE-2026-102106 | Critical | 9.1 | 2026-09-30 | Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not… |
CVE-2026-102105 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102104 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102103 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102102 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102095 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side… |
CVE-2026-102143 | High | 7.5 | 2026-09-30 | An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload hand… |
CVE-2026-102128 | High | 7.5 | 2026-09-30 | An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not aut… |
CVE-2026-102131 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An… |
CVE-2026-102130 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the applicati… |
CVE-2026-102119 | High | 7.2 | 2026-09-30 | A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outsi… |
CVE-2026-102116 | High | 7.2 | 2026-09-30 | -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the ap… |
CVE-2026-102108 | High | 7.2 | 2026-09-30 | An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deseri… |
CVE-2026-102097 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated adm… |
CVE-2026-102089 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticate… |
CVE-2026-102127 | High | 7.0 | 2026-09-30 | An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature… |
CVE-2026-102135 | Medium | 6.6 | 2026-09-30 | On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that… |
CVE-2026-102146 | Medium | 6.5 | 2026-09-30 | An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbit… |
CVE-2026-102139 | Medium | 6.5 | 2026-09-30 | An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a part… |