CVE-2026-102097

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr	Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

History

08 Oct 2026, 13:43

Type	Values Removed	Values Added
References	~~() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr -~~	() https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr - Vendor Advisory
References	~~() https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json -~~	() https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json - Broken Link
First Time		Accellion Accellion kiteworks
CPE		cpe:2.3:a:accellion:kiteworks::::::::

30 Sep 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 21:16

Updated : 2026-10-08 13:43

NVD link : CVE-2026-102097

Mitre link : CVE-2026-102097

CVE.ORG link : CVE-2026-102097

JSON object : View

Products Affected

accellion

kiteworks

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-102097", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102097", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T13:25:27.090508Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "affectedData": [{"vendor": "Kiteworks", "product": "Email Protection Gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "9.5.0", "versionType": "custom"}, {"status": "unaffected", "version": "9.5.0"}], "defaultStatus": "unknown"}]}], "published": "2026-09-30T21:16:56.370", "references": [{"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr", "tags": ["Vendor Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json", "tags": ["Broken Link"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway."}], "lastModified": "2026-10-08T13:43:06.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B7F84D9-5921-4C79-9B9D-628CC0EB3665", "versionEndExcluding": "9.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}