Riskcovery

CVE-2026-102104

Kiteworks Email Protection Gateway server-side request forgery

State
Published
Severity
9.1 Critical
Published
Sep 30, 2026
Updated
Oct 1, 2026
Reserved
Sep 28, 2026

Read the record on cve.org

Description

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway performs an online certificate status check for an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hcisa-cg

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
Email Protection GatewayKiteworks
  • before 9.5.0Affected
  • 9.5.0Not affected

References

  • urlvendor-advisory
  • urlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.