CVE-2026-102130: Kiteworks Email Protection Gateway Remote Code Execution

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-08
Weakness: CWE-94

Description

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.

Affected products

Kiteworks Email Protection Gateway: before 9.5.1 — fixed in 9.5.1

How to fix

Upgrade to a fixed version: Kiteworks Email Protection Gateway 9.5.1. Check the vendor advisory for mitigations.

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m92m-q8cf-rcch
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Get alerted when CVE-2026-102130 or the next vulnerability affects your stack