CVE-2026-102149

Analyzed Analyzed - Analysis Complete

Certificate Misassignment in Kiteworks Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-10-07

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102149

EUVD

EUVD-2026-90385

Affected Vendors & Products

Vendor	Product	Version / Range
accellion	kiteworks	to 9.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Kiteworks Email Protection Gateway had a flaw where certificates could be assigned to unintended user accounts. This allowed attackers to link a certificate to another user's account, compromising the confidentiality and integrity of encrypted emails for that account. If certificate-based login was enabled, it could also lead to unauthorized access.

Detection Guidance

This vulnerability involves improper certificate assignment in Kiteworks Email Protection Gateway. Detection requires checking for misassigned certificates and unauthorized access attempts. Review Kiteworks logs for certificate association anomalies and inspect user account bindings. No specific commands are provided in the context.

Impact Analysis

If you use Kiteworks Email Protection Gateway, an attacker could access your encrypted emails or gain unauthorized entry to your account if certificate-based login is enabled. This could expose sensitive communications and personal data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data confidentiality and integrity. Organizations may face compliance penalties if such breaches occur.

Mitigation Strategies

Update Kiteworks Email Protection Gateway to the latest version to ensure proper certificate assignment restrictions are enforced. Review and audit all certificate assignments to verify no unauthorized associations exist. Disable certificate-based login if not required to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-102149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70