CVE-2026-102108

Received Received - Intake

Authenticated Code Execution in Kiteworks Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102108

EUVD

EUVD-2026-90311

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	email_protection_gateway	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is a deserialization vulnerability in Kiteworks Email Protection Gateway. An authenticated admin with specific queue-management privileges can submit a crafted serialized object to a cluster management interface. The system deserializes this object without proper validation, which could allow arbitrary code execution under the gateway service account.

Impact Analysis

If exploited, this vulnerability could let an attacker run malicious code on the affected system with the privileges of the gateway service account. This may lead to unauthorized access, data breaches, or disruption of email protection services.

Compliance Impact

This vulnerability could compromise data confidentiality and integrity, potentially violating GDPR and HIPAA requirements for protecting sensitive data. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately restrict administrator access to the queue-management privilege and ensure all administrator accounts follow least-privilege principles. Review and validate all serialized object deserialization processes in the Kiteworks Email Protection Gateway cluster management interface.

Hi! I’m here to help you understand CVE-2026-102108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70