EUVD-2026-90311Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable interface (AV:N), no special complexity (AC:L), requires a specific privileged admin role so PR:H, no user interaction; deserialization yields code execution as the service account giving full C:H/I:H/A:H within the same component (S:U).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.
AnalysisAI
Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated administrator account that specifically holds the queue-management privilege on Kiteworks Email Protection Gateway versions before 9.5.0, plus network access to the cluster management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) is internally consistent with the description: network-reachable cluster management interface, low attack complexity, but requiring high privileges (an authenticated administrator holding a specific queue-management entitlement) and full CIA loss via code execution as the gateway service account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Email Protection Gateway to version 9.5.0 or later, which is the first release outside the affected range (<9.5.0) and the vendor-released patch for this issue; consult the Kiteworks security advisory (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-837h-99j2-hxjr) for the exact fixed build and any deployment-specific instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kiteworks Email Protection Gateway instances and confirm which are running versions earlier than 9.5.0, then restrict access to the cluster management interface to a minimal set of trusted administrative networks and review accounts holding the queue-management privilege for anything unexpected or dormant. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today