Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg
CVE-2026-102130Kiteworks Email Protection Gateway Remote Code Execution
High 7.2
In plain English
A high-severity code injection in Email Protection Gateway from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.2%top 32.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kiteworks | Email Protection Gateway | 0 – before 9.5.1 |
Weakness: CWE-94, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H