The vulnerability arises from an XML parser in Kiteworks Email Protection Gateway that does not properly restrict external entity references (CWE-611). If an optional message-processing feature is enabled, a remote unauthenticated attacker can craft a message that triggers the parser to access and exfiltrate files accessible to the gateway's service account. This includes sensitive data such as cryptographic key material and credentials, which could be sent to an attacker-controlled destination. The CVSS 3.1 score is 7.0, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows remote unauthenticated attackers to read sensitive files on the Kiteworks Email Protection Gateway, including cryptographic keys and credentials. This compromises confidentiality and could lead to further attacks or unauthorized access. The integrity impact is limited, and availability impact is low but present.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the optional, non-default message-processing feature that enables the vulnerable XML parser if possible, to prevent exploitation.