EUVD-2026-90385Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-306 missing authentication supports PR:N/AV:N/AC:L; confidentiality and integrity of victim mail/account are high, but no availability impact is described, so A:N (vendor A:L unsubstantiated).
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account.
AnalysisAI
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker to bind a certificate to another user's account, compromising the confidentiality and integrity of that account's encrypted mail. In deployments where certificate-based login is enabled, this can escalate to unauthorized account access; no public exploit was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the Kiteworks Email Protection Gateway's certificate-assignment function, which per CWE-306 lacks proper restriction on the target account - no authentication is asserted by the CVSS vector (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a genuinely high-priority flaw, though some noise exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from the Kiteworks security advisory GHSA-c9w5-4frw-7wqq and check CISA CSAF VA-26-274-01 for any updated guidance; the exact patched version is not supplied in the provided data, so confirm the fixed release in the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Kiteworks Email Protection Gateway instances are internet-facing and determine whether certificate-based login is enabled on any of them; where it is enabled, disable certificate-based authentication as the login mechanism until a fix is issued, and where it is not, restrict inbound access to trusted networks and IP ranges via firewall or reverse-proxy rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today