EUVD-2026-90289Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Agree AV:N/AC:L/PR:N/UI:N for the unauthenticated remote gateway path, but 'control of a platform account' yields C:H as well as I:H, so I raise C above the vendor's C:N (~8.1).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtain control of a platform account.
AnalysisAI
Improper authentication in Kiteworks Email Protection Gateway allows a remote, unauthenticated sender to make the gateway act against the Kiteworks platform as an identity it never verified, and to provision a new platform account for an identity the gateway does not already know - ultimately yielding control of a single platform account. Exploitation requires only network reachability to the gateway's message-processing path plus an inbound message asserting an identity; no credentials, privileges, or user interaction are involved (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Kiteworks Email Protection Gateway's message-processing path as a remote sender; no authentication, credentials, or user interaction are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All exploitability signals point the same direction as a genuine concern but the impact ceiling is bounded. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix documented in the Kiteworks security advisory GHSA-qjvp-25r3-rgx6 (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qjvp-25r3-rgx6); the exact patched version is not specified in the provided data, so confirm the fixed build against that advisory and the accompanying CISA CSAF file (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json) before closing the finding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kiteworks Email Protection Gateway deployments and confirm whether the message-processing path is reachable from untrusted networks; if so, restrict access to trusted relay IPs, disable automatic account provisioning for unknown identities where supported, and enable alerting on gateway-provisioned accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today