CVE-2026-102131

Received Received - Intake

Kiteworks Email Protection Gateway Code Execution

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102131

EUVD

EUVD-2026-90286

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	email_protection_gateway	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in Kiteworks Email Protection Gateway involves improper validation of configuration settings. An authenticated admin could exploit unrecognized input formats to write and execute a file on the gateway, leading to code execution with the gateway's service account privileges.

Impact Analysis

An attacker with admin access could execute arbitrary code on the gateway, potentially compromising sensitive data, disrupting email services, or gaining control over the system. This could lead to data breaches or unauthorized access to protected information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Apply the latest security patches or updates from Kiteworks to address the configuration validation issue. Restrict administrative access to the Email Protection Gateway to trusted personnel only. Monitor gateway logs for unusual file writes or execution attempts. Consider disabling unnecessary services or features that could be exploited.

Hi! I’m here to help you understand CVE-2026-102131. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70