CVE-2026-102130: Kiteworks Email Protection Gateway Remote Code Execution

Published Sep 30, 2026

Updated

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.

Affected Software

1 affected component

Kiteworks Email Protection Gateway

Event History

Sep 30, 2026

CVE Published

via MITRE·08:13 PM

Data Sourced

via MITRE·08:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker must be authenticated as an administrator and able to upload a backup to the gateway.

What privileges could successful exploitation provide?

Successful exploitation could allow arbitrary code execution on the gateway with the permissions of the underlying service account.

CVE-2026-102130: Kiteworks Email Protection Gateway Remote Code Execution

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

What privileges could successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What privileges could successful exploitation provide?