CVE-2026-102128: Kiteworks Email Protection Gateway Improper Authentication
An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtain control of a platform account.
Affected Software
Event History
Frequently Asked Questions
Which deployment is affected?
The affected software is Kiteworks Email Protection Gateway.
Does exploitation require credentials or user interaction?
No. The issue can potentially be exploited by a remote, unauthenticated sender, and the supplied vector indicates no user interaction is required.
What is the potential impact of successful exploitation?
An attacker could potentially cause the gateway to act on the Kiteworks platform as an unauthenticated user, provision an account for an unknown identity, and obtain control of a platform account.