CVE-2026-102144

Received Received - Intake

Resource Exhaustion in Kiteworks Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102144

EUVD

EUVD-2026-90268

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a resource exhaustion issue in Kiteworks Email Protection Gateway. An unauthenticated remote attacker can repeatedly trigger a costly server-side operation, leading to a partial denial of service.

Impact Analysis

It can cause service disruptions by consuming server resources, making the email protection gateway less responsive or temporarily unavailable for legitimate users.

Mitigation Strategies

Apply the latest security patches or updates provided by Kiteworks for the Email Protection Gateway to address the resource exhaustion issue. Monitor network traffic for unusual patterns indicating repeated server-side operations. Consider implementing rate limiting or throttling mechanisms to prevent excessive requests.

Hi! I’m here to help you understand CVE-2026-102144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70