CVE-2026-102112: Kiteworks Core Local Privilege Escalation

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-07
Weakness: CWE-78

Description

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.

Affected products

Kiteworks Email Protection Gateway: before 9.5.0 — fixed in 9.5.0

How to fix

Upgrade to a fixed version: Kiteworks Email Protection Gateway 9.5.0. Check the vendor advisory for mitigations.

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-658c-86vw-g9hf
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Get alerted when CVE-2026-102112 or the next vulnerability affects your stack