Email Protection Gateway

A critical vulnerability tracked as CVE-2026-102106, carrying a CVSS score of 9.1, has been disclosed affecting Kiteworks' Email Protection Gateway. The flaw is classified as improper authentication, meaning attackers could potentially bypass identity checks to gain unauthorized access. Security professionals are circulating the advisory and urging organizations using the product to review exposure and apply patches.

A server-side request forgery (SSRF) flaw in Kiteworks' Email Protection Gateway has been catalogued as CVE-2026-102105. Vulnerability-tracking services have added the issue to their radar, flagging it to security teams. Kiteworks is a platform used to share files and sensitive communications securely, so a flaw in its email gateway draws attention from defenders concerned attackers could abuse it to probe internal networks.

A new vulnerability, EUVD-2026-90275, has been recorded for Kiteworks' Email Protection Gateway, with a CVSS v3.1 score of 6.5 out of 10. The flaw concerns an authorization check in the large file exchange feature that failed to correctly verify whether the requesting user was entitled to access the resource. The entry was updated on 30 September 2026. Security teams monitoring Kiteworks deployments are expected to review the advisory and patch guidance.

A critical vulnerability, CVE-2026-102106, has been disclosed in Kiteworks Email Protection Gateway, rated CVSS 9.1. The flaw involves improper authentication: an administrative service did not consistently enforce administrator authentication, meaning the required password check could be bypassed. Security researchers are flagging the issue as it could allow unauthorized administrative access to the gateway, potentially exposing sensitive email protection infrastructure.

A critical vulnerability, CVE-2026-102105, has been disclosed in Kiteworks Email Protection Gateway versions before 9.5.0. The flaw, rated CVSS 9.1, is a server-side request forgery that could let a remote, unauthenticated attacker send requests from the affected server. Security teams are being urged to update to version 9.5.0 or later to close the issue.

A critical vulnerability, tracked as CVE-2026-102104 with a CVSS score of 9.1, has been disclosed in Kiteworks Email Protection Gateway versions before 9.5.0. The flaw is a server-side request forgery (SSRF) issue that could allow a remote, unauthenticated attacker to manipulate the gateway. Security teams are being urged to check whether their deployments are affected and update to version 9.5.0 or later.