CVE-2026-102131

Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity

State: Published
Severity: 7.2 High
Published: Sep 30, 2026
Updated: Oct 1, 2026
Reserved: Sep 28, 2026

Description

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	cisa-cg

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-178 Improper Handling of Case Sensitivity

Affected Products

Product	Versions
Email Protection GatewayKiteworks	before 9.5.0Affected 9.5.0Not affected

References

urlvendor-advisory
urlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.