CVE-2026-102146

Received Received - Intake

Authenticated File Write Vulnerability in Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102146

EUVD

EUVD-2026-90382

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated Email Protection Gateway administrator with limited permissions to write files containing attacker-controlled content to arbitrary locations accessible to the service account. This violates the intended privilege boundaries and could be exploited to modify application files, alter configurations, or disrupt service availability.

Impact Analysis

An attacker could exploit this to alter critical application files or configurations, potentially leading to data breaches, service outages, or unauthorized access. It may also allow attackers to escalate privileges or maintain persistent access within the system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Review and restrict file write permissions for the Email Protection Gateway service account to only necessary directories. Ensure administrators have the least privileges required for their roles. Monitor for unauthorized file modifications in application directories.

Hi! I’m here to help you understand CVE-2026-102146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70