Skip to main content

Email Protection Gateway EUVDEUVD-2026-90268

| CVE-2026-102144 MEDIUM
Missing Authentication for Critical Function (CWE-306)
2026-09-30 cisa-cg
Authentication Bypass Denial Of Service Kiteworks Email Protection Gateway
5.3
CVSS 3.1 · Vendor: cisa-cg
Share

Severity by source

Vendor (cisa-cg) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Unauthenticated network-reachable expensive operation (AV:N/AC:L/PR:N/UI:N) causing only partial availability loss (A:L), no confidentiality or integrity impact, unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Analysis Generated
Sep 30, 2026 - 22:55 vuln.today
Patch available
Sep 30, 2026 - 21:04 EUVD
CVE Published
Sep 30, 2026 - 20:09 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.

AnalysisAI

Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication required - the affected server-side operation is exposed to unauthenticated remote clients on Kiteworks Email Protection Gateway versions before 9.5.1 (CWE-306, missing authentication for a critical function). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but low-priority network-facing DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor fix by upgrading Kiteworks Email Protection Gateway to version 9.5.1 or later; vendor-released patch: 9.5.1 (Patch status: Available from vendor), and confirm the exact release and deployment guidance in GitHub Security Advisory GHSA-wwhf-5862-rjxq (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwhf-5862-rjxq) and the associated CISA CSAF advisory VA-26-274-01 (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Kiteworks

View all
CVE-2026-102115 CRITICAL
9.8 Sep 30

Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
CVE-2026-102149 CRITICAL
9.4 Sep 30

Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker

CVE-2026-102147 CRITICAL
9.3 Sep 30

Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
CVE-2026-102106 CRITICAL
9.1 Sep 30

Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
CVE-2026-102105 CRITICAL
9.1 Sep 30

Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
CVE-2026-102095 CRITICAL
9.1 Sep 30

Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
CVE-2026-102104 CRITICAL
9.1 Sep 30

Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
CVE-2026-102103 CRITICAL
9.1 Sep 30

Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
CVE-2026-102102 CRITICAL
9.1 Sep 30

Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
CVE-2026-102120 HIGH
8.8 Sep 30

Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
CVE-2026-102125 HIGH
8.8 Sep 30

Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
CVE-2025-53939 HIGH
8.8 Nov 29

Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-61757 CRITICAL POC
9.8
CVE-2025-32433 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

EUVD-2026-90268 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy