EUVD-2026-90303Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin function (AV:N/AC:L) but requires administrator privileges (PR:H); write-then-execute yields full RCE as the service account, so C:H/I:H/A:H with no scope change.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account.
AnalysisAI
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Kiteworks Email Protection Gateway administrator session (PR:H) - this is an administrative file-handling operation, not an unauthenticated network endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, not urgent, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Treat the vendor advisory (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-pf8p-p269-4mjv) as the authoritative source: patch status is documented there, and the input data does not enumerate a specific fixed build, so confirm the exact remediated version with Kiteworks before upgrading the Email Protection Gateway rather than assuming any release is unaffected. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Kiteworks Email Protection Gateway instance in the environment, record its version, and confirm who holds administrator rights on each appliance; restrict management and administrative interfaces to trusted internal networks or a jump host, and verify that no administrative interface is internet-exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today