This vulnerability involves improper deserialization of untrusted data (CWE-502) in Kiteworks Email Protection Gateway when database replication is enabled. A trusted party within the cluster can submit malicious serialized objects that the system deserializes without adequate validation, which may allow arbitrary code execution under the gateway service account. The vulnerability requires that replication be enabled and that the attacker have control over a trusted cluster peer or administrative access to the appliance.

Successful exploitation could lead to code execution with the privileges of the gateway service account, potentially compromising the affected appliance and its data. However, exploitation requires high privileges or trusted cluster control, limiting the attack surface. The vulnerability has a CVSS v3.1 score of 6.6, indicating a medium severity impact with high confidentiality, integrity, and availability impact but requiring high privileges and no user interaction.

No explicit patch or remediation is provided in the available data. Replication is disabled by default, which mitigates exposure. Organizations should verify if replication is enabled and restrict access to trusted cluster peers and administrative interfaces. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.