All vulnerabilities
CVE-2026-102131GHSA-62f6-c955-4fhq

Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity

Kiteworks Email Protection GatewayNetwork & edge
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.19%Chance of exploitation activity in the next 30 days, higher than 67% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.5.0Fixed versionCVE List
Published30 Sep 2026Updated 2 Oct 2026CVE List

What fixes it

  • 9.5.0Email Protection GatewayCVE List
  • 9.5.0Kiteworks Email Protection Gateway, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.

Text from CVE List

Affected versions 3

  • Email Protection Gatewayaffected: all versions before 9.5.0CVE List
  • Email Protection Gatewayunaffected: 9.5.0CVE List
  • Kiteworks Email Protection Gateway, other< 9.5.0GitHub

References 2