EUVD-2026-90290Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Unauthenticated remote sender (PR:N/AV:N), AC:H because exploitation depends on a non-default feature; C:H for key/credential disclosure, I:L/A:L for XXE out-of-band and resource side effects.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.
AnalysisAI
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the optional, NON-DEFAULT message-processing feature of Kiteworks Email Protection Gateway to be explicitly enabled - on a default configuration the vulnerable XML parsing path is not reached. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely serious vulnerability class (unauthenticated XXE leading to secret disclosure), but multiple signals temper its real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the supplied intelligence; consult the Kiteworks advisory GHSA-9jwc-h943-6f84 (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84) for the fixed release and apply it as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine which Kiteworks Email Protection Gateway instances have the optional message-processing feature enabled and disable it on any system that does not have a documented operational requirement, since this feature is the only reachable path for CVE-2026-102127; simultaneously restrict outbound network egress from the gateway so it cannot initiate connections to arbitrary external destinations, and review gateway logs for anomalous outbound traffic or unexpected file retrieval activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Share
External POC / Exploit Code
Leaving vuln.today