Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg

CVE-2026-102127Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

High 7.0

In plain English

A high-severity XML external entity in Email Protection Gateway from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 91.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.

Affected products (as reported)

Vendor	Product	Versions
Kiteworks	Email Protection Gateway	0 – before 9.5.1

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

References

url vendor-advisory
url third-party-advisory