This vulnerability involves improper authentication in an administrative service of the Kiteworks Email Protection Gateway. The flaw allows bypassing the required password check for administrator accounts, enabling attackers to perform administrative actions without proper authentication. Actions include creating, modifying, or deleting internal users and managed domains, and altering security-feature configurations. The deletion of a managed domain also deletes its user accounts, which could lock out administrators from the gateway.

An attacker can bypass authentication controls on the administrative service, leading to unauthorized administrative actions such as user and domain management and security configuration changes. This can result in denial of service for legitimate administrators if managed domains are deleted, and compromise of the gateway's security posture. The CVSS score of 9.1 reflects a critical severity with high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, administrators should monitor vendor communications for updates. Until a fix is available, restrict access to the administrative service to trusted networks and users as a precaution.