EUVD-2026-90270Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network-reachable upload handler (PR:N/AV:N/AC:L) writes attacker-controlled files (I:H); no direct read (C:N) or service disruption (A:N) established by the description.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
6DescriptionCVE.org
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.
AnalysisAI
Unauthenticated file write in Kiteworks Email Protection Gateway lets any attacker who can reach the appliance's administrative upload endpoint push files containing attacker-controlled content onto the underlying filesystem, because that handler performs no authentication or authorization check (CWE-306, CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). The directly reachable impact is integrity-only - no standalone code execution is achievable, since achieving RCE would require chaining a separate vulnerability to relocate the written file into an executable location. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or user interaction required - the administrative upload handler does not authenticate the request (CWE-306), so any attacker with network access to the Email Protection Gateway's management/upload interface can write an attacker-controlled file to the appliance filesystem against a default deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk is genuine but bounded. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed release documented in the Kiteworks security advisory GHSA-3p9g-jh62-8f89 (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3p9g-jh62-8f89); the exact patched version number is not confirmed in the available data, and the CISA CSAF advisory va-26-274-01 (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json) should be consulted alongside it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether the Kiteworks Email Protection Gateway administrative upload endpoint is reachable from untrusted networks; if so, immediately restrict access to a trusted management VLAN, VPN, or bastion host, disable the endpoint if it is not required, and review appliance and web server logs for unexpected file uploads or unauthorized writes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today