CVE-2026-102127

Received Received - Intake

XML External Entity Processing in Kiteworks Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102127

EUVD

EUVD-2026-90290

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability involves an XML parser in Kiteworks Email Protection Gateway that fails to restrict external entity references. When a specific non-default feature is enabled, a remote attacker can send a crafted message to read files accessible to the gateway service account. This includes sensitive data like cryptographic keys and credentials, which are then sent to an attacker-controlled destination.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access sensitive files on the gateway system, including private keys and login credentials. This could lead to further compromise of the system, data breaches, or unauthorized access to protected resources.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR and HIPAA. Exposure of credentials or cryptographic keys may also undermine security controls mandated by these regulations.

Mitigation Strategies

Disable the optional message-processing feature that allows external entity references in the XML parser. Review and restrict file system permissions for the gateway service account to limit access to sensitive files like cryptographic keys and credentials.

Hi! I’m here to help you understand CVE-2026-102127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70