CVE-2026-102102 is a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Email Protection Gateway prior to version 9.5.0. The vulnerability arises when the gateway processes inbound messages and retrieves issuer certificates, allowing an unauthenticated remote attacker to induce the gateway to send crafted requests to internal or unintended network targets. This can potentially expose sensitive internal information or disrupt the gateway's functionality. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and availability impacts.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the gateway issue arbitrary requests to internal or unintended network destinations. This may lead to disclosure of sensitive internal information or cause denial of service conditions affecting the gateway's availability. The vulnerability does not impact integrity but has high confidentiality and availability impacts as per the CVSS vector.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor for updates from Kiteworks and consider network-level controls to restrict the gateway's outbound requests if feasible.