Kiteworks Email Protection Gateway improperly controls the generation of code due to incomplete validation of configuration settings. Although the gateway rejects certain configurations, it fails to recognize every form in which these settings can be supplied. An authenticated administrator can exploit this by supplying an unrecognized form of configuration to write a file of their choosing to the system and execute it, resulting in code execution with the privileges of the gateway service account. This vulnerability is tracked as CWE-94 (Improper Control of Generation of Code) and CWE-178 (Improper Neutralization of Code).

Successful exploitation allows an authenticated administrator to execute arbitrary code on the gateway with the privileges of the gateway service account. This can lead to full compromise of the gateway, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious configuration changes.