Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg

CVE-2026-102106Kiteworks Email Protection Gateway improper authentication

Critical 9.1

In plain English

A critical-severity improper authentication in Email Protection Gateway from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.1%top 35.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway.

Affected products (as reported)

Vendor	Product	Versions
Kiteworks	Email Protection Gateway	0 – before 9.5.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

url vendor-advisory
url third-party-advisory