CVE-2026-102094

Received Received - Intake

Kiteworks Email Protection Gateway Unsafe Reflection Flaw

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102094

EUVD

EUVD-2026-90376

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	email_protection_gateway	to 9.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

Kiteworks Email Protection Gateway before version 9.5.0 has a flaw called Unsafe Reflection. This means it doesn't properly control what code can be loaded from imported rule configurations. An authenticated admin with mail-rule privileges could trick the system into running unauthorized code, potentially affecting the mail-gateway service account.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the mail-gateway service account. This might lead to unauthorized access, data breaches, or disruption of email services. The impact depends on the permissions of the service account.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later to address the unsafe reflection vulnerability. Ensure only approved mail-processing components are loaded by restricting rule configuration privileges to trusted administrators.

Hi! I’m here to help you understand CVE-2026-102094. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70