EUVD-2026-90313Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Network admin service with inconsistent auth allows unauthenticated (PR:N) low-complexity manipulation and deletion of users/domains (I:H, A:H); no direct data read so C:N.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway.
AnalysisAI
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attackers reach administrative functions simply by citing a valid administrator account identifier, without supplying the corresponding password or any token. Exploitation allows creation, modification, or deletion of internal users and managed domains and changes to security-feature configuration; deleting a managed domain also removes its user accounts and can lock legitimate administrators out of the gateway, consistent with the assessed vector's high integrity and availability impact and no confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Kiteworks Email Protection Gateway administrative service and knowledge of a valid administrator account reference/identifier that the attacker can cite; the vulnerable code path then fails to enforce the associated password check (CWE-287), so no credentials or prior authentication are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority within its deployment niche, though tempered by product footprint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading Kiteworks Email Protection Gateway to 9.5.0 or later, the exact fixed version identified in the advisory data; this eliminates the missing password enforcement in the administrative service and is the only complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kiteworks Email Protection Gateway instances and identify any running versions before 9.5.0; if any administrative interface is internet-facing or broadly reachable, restrict access to trusted management networks or trusted IP ranges, and preserve logs for review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today