CVE-2026-102130: Kiteworks Email Protection Gateway Remote Code Execution
Published Sep 30, 2026
·Updated
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.
Affected Software
2 affected components
Kiteworks Email Protection Gateway
Accellion Kiteworks<9.5.1
Event History
Sep 30, 2026
CVE Published
via MITRE·08:13 PM
Data Sourced
via MITRE·08:13 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must be authenticated as an administrator and able to upload a backup to the gateway.
2
What privileges could successful exploitation provide?
Successful exploitation could allow arbitrary code execution on the gateway with the permissions of the underlying service account.