CVE-2026-102094 describes an unsafe reflection vulnerability in Kiteworks Email Protection Gateway prior to version 9.5.0. The vulnerability arises because the gateway does not sufficiently restrict the classes or code that can be loaded from imported mail-rule configurations. An authenticated administrator with mail-rule configuration privileges can exploit this to load and execute code beyond the approved mail-processing components, potentially executing arbitrary code in the context of the mail-gateway service account.

Successful exploitation could result in arbitrary code execution with the privileges of the mail-gateway service account, potentially leading to full compromise of the email processing system. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is confirmed by the vendor advisory specifying the fixed version.