CVE-2026-102131: Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity
Published Sep 30, 2026
·Updated
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.
Affected Software
2 affected components
Kiteworks Email Protection Gateway
Accellion Kiteworks<9.5.0
Event History
Sep 30, 2026
CVE Published
via MITRE·08:13 PM
Data Sourced
via MITRE·08:13 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be an authenticated administrator of the Kiteworks Email Protection Gateway. The CVSS vector indicates exploitation is network-accessible, low complexity, and does not require user interaction.
2
What privileges would successful exploitation provide?
An attacker could write and execute a file of their choosing on the gateway. The resulting code execution runs as the gateway service account.