EUVD-2026-90382Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Network-reachable admin function, low complexity, but requires a delegated admin account (PR:H); write-only tampering yields I:H/A:H and C:N.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.
AnalysisAI
Authenticated file-write abuse in Kiteworks Email Protection Gateway (versions before 9.5.1) lets an administrator holding only limited, delegated permissions place attacker-controlled content at arbitrary filesystem locations writable by the EPG service account, exceeding the privileges that role is meant to grant. Successful exploitation allows tampering with application files and configuration, or disruption of service availability, but carries no confidentiality impact and does not by itself yield code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Email Protection Gateway administrator account that holds only limited, delegated permissions (PR:H) - no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, not top-tier, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading Email Protection Gateway to 9.5.1 or later; the fix is documented in the Kiteworks advisory GHSA-5pgq-v8g2-rg2f (https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5pgq-v8g2-rg2f) and in CISA CSAF VA-26-274-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today