What’s Vulnerable › Vulnerabilities
CVE-2026-29092: Kiteworks Email Protection Gateway has an Insufficient Session Expiration
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-25 · updated 2026-06-17
- Weakness: CWE-613
Description
Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
Affected products
- Kiteworks Email Protection Gateway: before 9.2.1 — fixed in 9.2.1
How to fix
Upgrade to a fixed version: Kiteworks Email Protection Gateway 9.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-29092 or the next vulnerability affects your stack