Email Protection Gateway
Monthly
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); a vendor patch is available in 9.5.0.
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attackers reach administrative functions simply by citing a valid administrator account identifier, without supplying the corresponding password or any token. Exploitation allows creation, modification, or deletion of internal users and managed domains and changes to security-feature configuration; deleting a managed domain also removes its user accounts and can lock legitimate administrators out of the gateway, consistent with the assessed vector's high integrity and availability impact and no confidentiality impact. The vendor has released fixed version 9.5.0, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV at time of analysis; the main gating factor is that the attacker must know or guess an existing administrative account reference and be able to reach the administrative service over the network.
Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and vendor-patched versions are available.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote attacker cause the gateway itself to send crafted requests to internal or otherwise unintended network destinations by simply sending an inbound message that triggers an online certificate status check. Because the request originates from the gateway's own network position, an attacker can potentially reach internal services that are not directly exposed, leading to sensitive information disclosure and, depending on reachable targets, disruption of gateway availability. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); exploitation is nevertheless trivially reachable since it requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 9.1), with realized impact bounded by the gateway's internal network position and egress restrictions.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) to make the gateway fetch attacker-chosen URLs by embedding a crafted certificate revocation list reference in an inbound message. Successful exploitation yields disclosure of information reachable from the gateway's network position or disruption of gateway availability, but no write access or code execution (I:N), so practical severity is bounded by what internal or cloud-metadata endpoints the appliance can actually reach - landing it in the medium operational-priority band despite the critical base score. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
Improper authentication in Kiteworks Email Protection Gateway allows a remote, unauthenticated sender to make the gateway act against the Kiteworks platform as an identity it never verified, and to provision a new platform account for an identity the gateway does not already know - ultimately yielding control of a single platform account. Exploitation requires only network reachability to the gateway's message-processing path plus an inbound message asserting an identity; no credentials, privileges, or user interaction are involved (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and there is no evidence of active exploitation or public tooling; the vendor's CVSS 3.1 score is 7.5 with integrity-only impact, while independent assessment raises the confidentiality component to High (C:H/I:H/A:N) because account takeover implies read access to that account's data, though the realistic blast radius remains a single platform account rather than the underlying appliance.
Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.
Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthenticated attacker who can deliver an inbound message cause the gateway to issue crafted HTTP requests to internal or otherwise unintended network destinations, with the trigger occurring during the gateway's issuer-certificate retrieval step. With CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), a successful attack can disclose sensitive internal information reachable from the gateway's network position and/or disrupt gateway operation, but the practical impact is bounded by which internal services and metadata endpoints the gateway can reach and by whether any response data is reflected back to the attacker rather than being blind. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), though the combination of network reachability, no authentication, and no user interaction makes this a genuine priority within the email security gateway niche.
Unauthenticated file write in Kiteworks Email Protection Gateway lets any attacker who can reach the appliance's administrative upload endpoint push files containing attacker-controlled content onto the underlying filesystem, because that handler performs no authentication or authorization check (CWE-306, CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). The directly reachable impact is integrity-only - no standalone code execution is achievable, since achieving RCE would require chaining a separate vulnerability to relocate the written file into an executable location. No public exploit code exists and no confirmed active exploitation was identified at time of analysis, so risk is genuine but bounded, concentrated on deployments that expose the management/upload interface to untrusted networks rather than those that firewall it to a management VLAN.
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker to bind a certificate to another user's account, compromising the confidentiality and integrity of that account's encrypted mail. In deployments where certificate-based login is enabled, this can escalate to unauthorized account access; no public exploit was identified at time of analysis. The flaw maps to CWE-306 and carries a high assessed severity, though impact is bounded to encrypted-mail confidentiality and integrity unless certificate-based login is in use.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. No public exploit code has been identified at time of analysis; the issue is nevertheless high priority given the unauthenticated network vector, with our independent assessment scoring integrity impact as Low (reflecting that state changes depend on which internal endpoint is reachable) rather than the published vector's High.
Unsafe reflection in Kiteworks Email Protection Gateway (all versions before 9.5.0) allows an authenticated administrator holding mail-rule configuration privileges to import a crafted rule configuration that causes the mail-processing pipeline to load and execute code outside the approved set of mail-processing components, resulting in code execution in the context of the mail-gateway service account (CVSS 3.1 base 7.2, High; vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind a high-privilege account (PR:H) with mail-rule import rights and requires no victim interaction, so the practical exposure is insider abuse or lateral movement after an attacker has already compromised such an administrative account; there is no unauthenticated or anonymous path. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor-supplied fix is version 9.5.0.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
Code execution as the gateway service account can be achieved by a trusted party in a Kiteworks Email Protection Gateway cluster that has database replication enabled, via submission of a crafted serialized object that is deserialized without sufficient validation (CWE-502). The flaw is heavily gated: replication is disabled by default, so standard standalone deployments are not exposed, and the attacker must either control a trusted cluster peer or already hold administrative access to the appliance - meaning realistic exploitation is limited to insider abuse, post-compromise lateral movement, or a malicious administrator rather than opportunistic remote attack. All releases below 9.5.1 are affected, a vendor patch (9.5.1) is available, and no public exploit code or confirmed active exploitation was identified at time of analysis; the assessed CVSS is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity and high privileges required.
Authenticated users of Kiteworks Email Protection Gateway versions before 9.5.1 can read the subject, message body, and attachments of large file exchange packages they neither sent nor received. Exploitation requires a valid account (PR:L) and the optional large file exchange feature to be enabled and in use; no public exploit has been identified at time of analysis. The flaw is rated moderate severity (CVSS 6.5), with confidentiality-only impact and a vendor patch available in 9.5.1.
Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in version 9.5.1, and the issue is tracked as EUVD-2026-90268 with advisory GHSA-wwhf-5862-rjxq.
Authenticated file-write abuse in Kiteworks Email Protection Gateway (versions before 9.5.1) lets an administrator holding only limited, delegated permissions place attacker-controlled content at arbitrary filesystem locations writable by the EPG service account, exceeding the privileges that role is meant to grant. Successful exploitation allows tampering with application files and configuration, or disruption of service availability, but carries no confidentiality impact and does not by itself yield code execution. Exploitation requires a valid delegated-admin account and session (CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base score 6.5), and no public exploit identified at time of analysis.
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); a vendor patch is available in 9.5.0.
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attackers reach administrative functions simply by citing a valid administrator account identifier, without supplying the corresponding password or any token. Exploitation allows creation, modification, or deletion of internal users and managed domains and changes to security-feature configuration; deleting a managed domain also removes its user accounts and can lock legitimate administrators out of the gateway, consistent with the assessed vector's high integrity and availability impact and no confidentiality impact. The vendor has released fixed version 9.5.0, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV at time of analysis; the main gating factor is that the attacker must know or guess an existing administrative account reference and be able to reach the administrative service over the network.
Authenticated administrators holding a specific queue-management privilege on Kiteworks Email Protection Gateway (versions before 9.5.0) can submit a crafted serialized object to the cluster management interface that is deserialized without sufficient validation, resulting in arbitrary code execution in the context of the gateway service account. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) makes clear this is not reachable by unauthenticated users, standard users, or admins lacking the queue-management entitlement, and no user interaction is required once a suitably privileged account exists. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and vendor-patched versions are available.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote attacker cause the gateway itself to send crafted requests to internal or otherwise unintended network destinations by simply sending an inbound message that triggers an online certificate status check. Because the request originates from the gateway's own network position, an attacker can potentially reach internal services that are not directly exposed, leading to sensitive information disclosure and, depending on reachable targets, disruption of gateway availability. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); exploitation is nevertheless trivially reachable since it requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 9.1), with realized impact bounded by the gateway's internal network position and egress restrictions.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) to make the gateway fetch attacker-chosen URLs by embedding a crafted certificate revocation list reference in an inbound message. Successful exploitation yields disclosure of information reachable from the gateway's network position or disruption of gateway availability, but no write access or code execution (I:N), so practical severity is bounded by what internal or cloud-metadata endpoints the appliance can actually reach - landing it in the medium operational-priority band despite the critical base score. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
Improper authentication in Kiteworks Email Protection Gateway allows a remote, unauthenticated sender to make the gateway act against the Kiteworks platform as an identity it never verified, and to provision a new platform account for an identity the gateway does not already know - ultimately yielding control of a single platform account. Exploitation requires only network reachability to the gateway's message-processing path plus an inbound message asserting an identity; no credentials, privileges, or user interaction are involved (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and there is no evidence of active exploitation or public tooling; the vendor's CVSS 3.1 score is 7.5 with integrity-only impact, while independent assessment raises the confidentiality component to High (C:H/I:H/A:N) because account takeover implies read access to that account's data, though the realistic blast radius remains a single platform account rather than the underlying appliance.
Remote code execution in Kiteworks Email Protection Gateway allows an authenticated administrator to upload a crafted backup file that the product fails to sufficiently validate, then influence how the application loads it so that attacker-supplied code executes under the gateway's underlying service account. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection; exploitation is gated by high-privilege authentication, making it a realistic post-compromise, insider, or credential-chaining vector rather than an unauthenticated internet-wide threat. No public exploit code and no confirmed active exploitation (CISA KEV) were identified for this CVE at time of analysis, and no EPSS score was supplied in the available intelligence.
Remote code execution on the Kiteworks Email Protection Gateway is achievable by an authenticated administrator who supplies a configuration setting in a form the gateway's input validation does not recognize, allowing an otherwise-rejected value to be written to the appliance as a file and executed under the gateway service account. The vendor rates this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and our independent assessment concurs: the flaw is network-reachable, low-complexity, and requires no user interaction, but it is gated behind high administrative privileges (PR:H), so it is not exploitable by unauthenticated or low-privileged users. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; realistic risk therefore hinges on admin-credential compromise, insider misuse, or chaining from a separate privilege-escalation flaw rather than opportunistic mass exploitation.
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthenticated attacker who can deliver an inbound message cause the gateway to issue crafted HTTP requests to internal or otherwise unintended network destinations, with the trigger occurring during the gateway's issuer-certificate retrieval step. With CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), a successful attack can disclose sensitive internal information reachable from the gateway's network position and/or disrupt gateway operation, but the practical impact is bounded by which internal services and metadata endpoints the gateway can reach and by whether any response data is reflected back to the attacker rather than being blind. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), though the combination of network reachability, no authentication, and no user interaction makes this a genuine priority within the email security gateway niche.
Unauthenticated file write in Kiteworks Email Protection Gateway lets any attacker who can reach the appliance's administrative upload endpoint push files containing attacker-controlled content onto the underlying filesystem, because that handler performs no authentication or authorization check (CWE-306, CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). The directly reachable impact is integrity-only - no standalone code execution is achievable, since achieving RCE would require chaining a separate vulnerability to relocate the written file into an executable location. No public exploit code exists and no confirmed active exploitation was identified at time of analysis, so risk is genuine but bounded, concentrated on deployments that expose the management/upload interface to untrusted networks rather than those that firewall it to a management VLAN.
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker to bind a certificate to another user's account, compromising the confidentiality and integrity of that account's encrypted mail. In deployments where certificate-based login is enabled, this can escalate to unauthorized account access; no public exploit was identified at time of analysis. The flaw maps to CWE-306 and carries a high assessed severity, though impact is bounded to encrypted-mail confidentiality and integrity unless certificate-based login is in use.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. No public exploit code has been identified at time of analysis; the issue is nevertheless high priority given the unauthenticated network vector, with our independent assessment scoring integrity impact as Low (reflecting that state changes depend on which internal endpoint is reachable) rather than the published vector's High.
Unsafe reflection in Kiteworks Email Protection Gateway (all versions before 9.5.0) allows an authenticated administrator holding mail-rule configuration privileges to import a crafted rule configuration that causes the mail-processing pipeline to load and execute code outside the approved set of mail-processing components, resulting in code execution in the context of the mail-gateway service account (CVSS 3.1 base 7.2, High; vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind a high-privilege account (PR:H) with mail-rule import rights and requires no victim interaction, so the practical exposure is insider abuse or lateral movement after an attacker has already compromised such an administrative account; there is no unauthenticated or anonymous path. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor-supplied fix is version 9.5.0.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
Code execution as the gateway service account can be achieved by a trusted party in a Kiteworks Email Protection Gateway cluster that has database replication enabled, via submission of a crafted serialized object that is deserialized without sufficient validation (CWE-502). The flaw is heavily gated: replication is disabled by default, so standard standalone deployments are not exposed, and the attacker must either control a trusted cluster peer or already hold administrative access to the appliance - meaning realistic exploitation is limited to insider abuse, post-compromise lateral movement, or a malicious administrator rather than opportunistic remote attack. All releases below 9.5.1 are affected, a vendor patch (9.5.1) is available, and no public exploit code or confirmed active exploitation was identified at time of analysis; the assessed CVSS is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity and high privileges required.
Authenticated users of Kiteworks Email Protection Gateway versions before 9.5.1 can read the subject, message body, and attachments of large file exchange packages they neither sent nor received. Exploitation requires a valid account (PR:L) and the optional large file exchange feature to be enabled and in use; no public exploit has been identified at time of analysis. The flaw is rated moderate severity (CVSS 6.5), with confidentiality-only impact and a vendor patch available in 9.5.1.
Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in version 9.5.1, and the issue is tracked as EUVD-2026-90268 with advisory GHSA-wwhf-5862-rjxq.
Authenticated file-write abuse in Kiteworks Email Protection Gateway (versions before 9.5.1) lets an administrator holding only limited, delegated permissions place attacker-controlled content at arbitrary filesystem locations writable by the EPG service account, exceeding the privileges that role is meant to grant. Successful exploitation allows tampering with application files and configuration, or disruption of service availability, but carries no confidentiality impact and does not by itself yield code execution. Exploitation requires a valid delegated-admin account and session (CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base score 6.5), and no public exploit identified at time of analysis.