CVE-2026-102105 is a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Email Protection Gateway prior to version 9.5.0. The vulnerability arises when the gateway processes email content that references external resources, enabling an unauthenticated remote attacker to induce the gateway to send crafted requests to internal or otherwise unintended network destinations. This can potentially expose sensitive internal information or cause unintended actions on internal systems accessible from the gateway.

An attacker exploiting this SSRF vulnerability can cause the Kiteworks Email Protection Gateway to issue unauthorized requests to internal network services or other unintended destinations. This may lead to sensitive information disclosure or trigger unintended operations on internal systems. The vulnerability does not affect availability but has high confidentiality and integrity impact, as reflected by the CVSS score of 9.1.

No explicit patch or remediation information is provided in the available data. Users should consult the Kiteworks vendor advisory for official fixes or mitigation guidance. Until a fix is confirmed, consider restricting network access from the gateway to sensitive internal resources and carefully review email content handling policies to reduce exposure.