EUVD-2026-90280Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AC:H because replication is non-default and a trusted-peer position is required; PR:H because a trusted cluster peer or admin access is needed; full C/I/A:H reflects service-account code execution.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
3DescriptionCVE.org
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance.
AnalysisAI
Code execution as the gateway service account can be achieved by a trusted party in a Kiteworks Email Protection Gateway cluster that has database replication enabled, via submission of a crafted serialized object that is deserialized without sufficient validation (CWE-502). The flaw is heavily gated: replication is disabled by default, so standard standalone deployments are not exposed, and the attacker must either control a trusted cluster peer or already hold administrative access to the appliance - meaning realistic exploitation is limited to insider abuse, post-compromise lateral movement, or a malicious administrator rather than opportunistic remote attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Kiteworks Email Protection Gateway deployed as a CLUSTER with DATABASE REPLICATION explicitly ENABLED - replication is disabled by default, so default installations are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-gated deserialization flaw, not an internet-facing critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Kiteworks Email Protection Gateway to 9.5.1 or later, which is the first fixed release covering the '0 <9.5.1' affected range; apply the vendor advisory GHSA-vmwr-r5xq-hp49 (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vmwr-r5xq-hp49) for the authoritative fix details and any ordered upgrade steps for clustered nodes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today