EUVD-2026-90376Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-manageable gateway (AV:N) but exploitation needs mail-rule admin privileges (PR:H); reflective code execution in the service account grants full C/I/A within the unchanged scope.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
6DescriptionCVE.org
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.
AnalysisAI
Unsafe reflection in Kiteworks Email Protection Gateway (all versions before 9.5.0) allows an authenticated administrator holding mail-rule configuration privileges to import a crafted rule configuration that causes the mail-processing pipeline to load and execute code outside the approved set of mail-processing components, resulting in code execution in the context of the mail-gateway service account (CVSS 3.1 base 7.2, High; vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind a high-privilege account (PR:H) with mail-rule import rights and requires no victim interaction, so the practical exposure is insider abuse or lateral movement after an attacker has already compromised such an administrative account; there is no unauthenticated or anonymous path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated administrator possessing mail-rule configuration privileges on the Kiteworks Email Protection Gateway (PR:H) who can import a rule configuration into the mail-processing pipeline. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) is internally consistent and I concur with it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kiteworks Email Protection Gateway to 9.5.0 or later, the vendor-released fix that restricts pipeline class loading to the approved mail-processing component allowlist; consult GitHub Security Advisory GHSA-9f5q-3c34-cpg8 for the authoritative upgrade instructions and any backport guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kiteworks Email Protection Gateway deployments and confirm their version; for any instance running a version below 9.5.0, immediately apply the vendor-released patch (version 9.5.0) or, if patching cannot be completed within that window, restrict mail-rule import permissions to only essential staff and enable enhanced monitoring for configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Share
External POC / Exploit Code
Leaving vuln.today