Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg

CVE-2026-102149Kiteworks Email Protection Gateway Improper Access Control

Critical 9.4

In plain English

A critical-severity missing authentication in Email Protection Gateway from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account.

Affected products (as reported)

Vendor	Product	Versions
Kiteworks	Email Protection Gateway	0 – before 9.5.1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

url
url third-party-advisory