Kiteworks Email Protection Gateway versions before 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when retrieving a certificate revocation list from inbound messages. Exploitation could lead to disclosure of sensitive internal information or disruption of gateway operations.
CVE-2026-102124 is a vulnerability in the Kiteworks Core appliance setup interface where authentication is not enforced after initial configuration. This allows an unauthenticated attacker with network access to read and modify certain setup records such as contact name and email address. The vulnerability affects versions prior to 9.5.0. The CVSS score is 6.5, indicating a medium severity impact with limited confidentiality and integrity impact but no availability impact.
CVE-2026-102125 is a high-severity vulnerability in Kiteworks Core where the sandbox used for document conversion does not fully isolate the code running inside it. This allows code executing within the sandbox to escape confinement and operate with the privileges of the service account running the application. Exploitation could enable an attacker to read or modify application data and configuration or disrupt the service on the affected appliance.
CVE-2026-102126 is a stored cross-site scripting (XSS) vulnerability in Kiteworks Core. It allows a lower-privileged administrator with a narrowly scoped delegated permission to store malicious content. This content executes arbitrary JavaScript in the session of a System Administrator who views the affected page, potentially escalating privileges to full administrative control, including creating new admin accounts. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. The CVSS score is 8.1, indicating high severity.
CVE-2026-102127 is a high-severity vulnerability in Kiteworks Email Protection Gateway involving improper restriction of XML external entity references. When an optional, non-default message-processing feature is enabled, a remote unauthenticated attacker can send a crafted message that exploits the XML parser to read files accessible to the gateway service account, including sensitive cryptographic keys and credentials. This could lead to unauthorized disclosure of critical information.
CVE-2026-102128 is an improper authentication vulnerability in Kiteworks Email Protection Gateway. It allows the gateway to act on the Kiteworks platform on behalf of an unauthenticated user and provision platform accounts for unknown identities. A remote attacker without authentication could exploit this flaw to gain control over a platform account. The vulnerability affects versions prior to 9.5.1. The CVSS score is 7.5, indicating high severity due to the potential for unauthorized account control without user interaction.
CVE-2026-102129 is a privilege escalation vulnerability in Kiteworks Core where the user-provisioning interface fails to verify if an administrator is authorized to assign certain roles. This flaw allows an administrator with limited delegated permissions for role changes to escalate an account to full system-administrator privileges. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. It has a high severity with a CVSS score of 7.2. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-102130 is a high-severity vulnerability in Kiteworks Email Protection Gateway where insufficient validation of uploaded backup content allows an authenticated administrator to influence the application's loading process. This flaw could enable arbitrary code execution on the gateway under the service account's privileges.
CVE-2026-102131 is a high-severity vulnerability in Kiteworks Email Protection Gateway that allows an authenticated administrator to bypass input validation and execute arbitrary code. The gateway improperly controls code generation by failing to recognize all forms of certain configuration settings, enabling code injection. This can lead to execution of attacker-controlled files with the gateway service account privileges.
CVE-2026-102132 is a high-severity vulnerability in Kiteworks Core where an administrative import function fails to verify if a delegated administrator is authorized to create privileged integration credentials. This flaw allows a delegated administrator with limited permissions to escalate privileges to full system administrator without intervention from an existing system administrator. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-102133 is a command injection vulnerability in the Kiteworks Core product affecting an optional repository-connector feature. This flaw allows an authenticated system administrator to inject commands via a user-supplied path that is not properly neutralized before being passed to an external command. Successful exploitation could lead to arbitrary code execution under the service account running the connector, requiring network egress to an attacker-controlled system. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
Kiteworks Email Protection Gateway versions before 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when processing inbound messages. Exploitation could lead to disclosure of sensitive internal information or disruption of the gateway's operation. The vulnerability has a high severity with a CVSS score of 9.1.
CVE-2026-102134 is a medium severity vulnerability in Kiteworks Core where gateway-level API security controls were not applied to all requests authenticated via the central authentication service. This allowed authenticated users to access REST API functionality through alternate request paths that bypassed controls such as enforcement of signed-out and revoked sessions.
CVE-2026-102135 is a deserialization vulnerability in Kiteworks Email Protection Gateway when database replication is enabled. A trusted cluster peer can submit a crafted serialized object that is deserialized without sufficient validation, potentially leading to code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access. The vulnerability affects versions prior to 9.5.1.
CVE-2026-102136 is a vulnerability in Kiteworks Core affecting multi-node deployments. An attacker with code execution on one node can submit crafted input via an internal cluster interface, which is insufficiently validated when written into monitoring configuration on another node. This can lead to execution of OS commands under an unprivileged service account on the second node. The vulnerability is classified as a CRLF injection (CWE-93) and impacts versions prior to 9.5.1. The CVSS score is 6.3, indicating a medium severity.
CVE-2026-102137 is a vulnerability in Kiteworks Core that allows an authenticated administrator to bypass content validation during administrative file uploads, enabling storage of files with dangerous content on the appliance. This vulnerability alone does not lead to code execution, as exploiting that would require another separate vulnerability.
CVE-2026-102138 is a server-side request forgery (SSRF) vulnerability in Kiteworks Core. It affects versions prior to 9.5.1 and requires an authenticated administrator on a node with the licensed gateway role enabled. The vulnerability allows the administrator to supply a connector URL that the server retrieves without sufficient validation, potentially causing requests to internal network services. The CVSS score is low (3.3), reflecting limited impact and high attack complexity.
Kiteworks Core versions before 9.5.0 contain a deserialization vulnerability (CWE-502) that could allow remote code execution if an attacker can influence the deserialized data. Exploitation requires the attacker to control the input data, so the vulnerability is not exploitable on its own. The issue is rated high severity with a CVSS score of 8.1.
CVE-2026-102139 is an authorization bypass vulnerability in the large file exchange feature of Kiteworks Email Protection Gateway. It allows an authenticated user to access the subject, message body, and attachments of email packages they neither sent nor received. This occurs because the system does not properly verify that the requesting user is a party to the requested package.
CVE-2026-102140 is a vulnerability in Kiteworks Core where an authenticated administrator can import files without full verification of their contents. The import process only validates the file header, allowing unverified or forged content to be processed. This flaw affects data integrity but does not impact confidentiality or availability. The vulnerability affects Kiteworks Core versions prior to 9.5.1. The CVSS score is 4.9, indicating a medium severity level.