EUVD-2026-90314Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote message delivery gives AV:N/AC:L/PR:N/UI:N; SSRF read-back gives C:H, but 'unintended actions' is limited/uncertain so I:L rather than I:H, and no availability impact.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems.
AnalysisAI
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is triggered when the Email Protection Gateway renders inbound message content that references external resources - i.e., the attacker only needs to deliver a crafted message to the gateway; no authentication, credentials, or victim interaction is required (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1 Critical) describes a genuinely low-barrier flaw: network-reachable, no authentication, no user interaction, and low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kiteworks Email Protection Gateway to version 9.5.0 or later, which is the vendor-released fix for CVE-2026-102105 (vendor patch available); follow the vendor advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-hq47-4whq-9hgv and the CISA CSAF record at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Kiteworks Email Protection Gateway and determine their versions; apply the vendor-released patch (upgrade to 9.5.0 or later) to any instance running a version before 9.5.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today