CVE-2026-102146
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.
Risk Assessment
May lead to integrity compromise of application files and configuration and to partial service unavailability. Requires an authenticated administrator account with limited permissions.
Recommendation
Restrict write permissions for delegated administrator accounts and enforce validation of target write paths. Apply the principle of least privilege to the service account.
Other vulnerabilities in Kiteworks Email Protection Gateway
See all- CVE-2026-102149Critical
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account.
- CVE-2026-102106Critical
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway.
- CVE-2026-102105Critical
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A remote, unauthenticated attacker can induce the gateway to issue crafted requests to internal or unintended network destinations while the gateway renders message content referencing external resources. This could disclose sensitive internal information or trigger unintended actions on internal systems.
- CVE-2026-102104Critical
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A remote, unauthenticated attacker can induce the gateway to issue crafted requests to internal or unintended network destinations while the gateway performs an online certificate status check for an inbound message. This could disclose sensitive internal information or disrupt gateway operation.
- CVE-2026-102103Critical
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A remote, unauthenticated attacker can induce the gateway to issue crafted requests to internal or unintended network destinations while the gateway retrieves a certificate revocation list in an inbound message. This could disclose sensitive internal information or disrupt gateway operation.
- CVE-2026-102102Critical
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A remote, unauthenticated attacker can induce the gateway to issue crafted requests to internal or unintended network destinations while the gateway retrieves an issuer certificate in an inbound message. This could disclose sensitive internal information or disrupt gateway operation.
- CVE-2026-102095Critical
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. The gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
- CVE-2026-102145Medium
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.
- CVE-2026-102144Medium
A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.
- CVE-2026-102140Medium
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.
Original NVD description (English source)
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS