EUVD-2026-90286Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin config interface (AV:N/AC:L) but requires administrator privileges (PR:H); code execution as service account yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.
AnalysisAI
Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated administrator account on the Kiteworks Email Protection Gateway with access to modify configuration settings (PR:H); the attack works over the network (AV:N) with low complexity (AC:L) and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine remote-code-execution-class flaw but its real-world risk is materially gated by the CVSS vector, which the vendor rates 7.2 (High) as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and no fix version is specified in the supplied data; the remediation path must be driven by the vendor advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-62f6-c955-4fhq, with the CISA CSAF record at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json as corroborating context. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether Kiteworks Email Protection Gateway is deployed and restrict administrative access to the appliance to only trusted personnel, enforce multi-factor authentication for all admin accounts, and review gateway configuration and file system logs for unauthorized changes or unexpected file writes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today