EUVD-2026-90377Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote sender, automated message processing (no UI); read-back of responses gives C:H, while state-effect on reached services is conditional/secondary (I:L) and no availability impact.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
AnalysisAI
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or user interaction required: the gateway must be deployed inbound-facing so that untrusted senders' messages are processed, which is its normal operating mode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, driven primarily by the unauthenticated network vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 9.5.0 (per advisory GHSA-f252-4w8q-g74g, https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f252-4w8q-g74g); upgrade the Email Protection Gateway to 9.5.0 or later, which removes the vulnerable server-side fetch behavior. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every Kiteworks Email Protection Gateway instance running a version earlier than 9.5.0 and determine which are hosted on cloud instances with an attached IAM role; for those, immediately restrict outbound egress from the appliance to only the destinations it genuinely requires, block reachability to cloud instance metadata endpoints such as 169.254.169.254 (enforcing IMDSv2 or the provider's hardened metadata equivalent), and reduce the attached IAM role to least privilege while opening a support case with Kiteworks to obtain a fix timeline or hotfix for the pre-9.5.0 code base. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today