Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg
CVE-2026-102135Kiteworks Email Protection Gateway Deserialization of Untrusted Data
Medium 6.6
In plain English
A medium-severity unsafe deserialization in Email Protection Gateway from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Official description
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kiteworks | Email Protection Gateway | 0 – before 9.5.1 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H