Server-Side Request Forgery in Kiteworks Email Protection Gateway
CVE-2026-102103

9.1CRITICAL

Key Information:

Vendor

Kiteworks

Status
Email Protection Gateway
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102103?

Kiteworks Email Protection Gateway prior to version 9.5.0 is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows unauthorized remote attackers to manipulate the gateway into issuing malicious requests to internal network locations or unintended destinations. The exploit occurs when the gateway attempts to fetch a certificate revocation list within inbound messages. As a result, this could potentially lead to the exposure of sensitive internal information or disrupt the normal operation of the gateway, posing significant security concerns for users.

Affected Version(s)

Email Protection Gateway 0 < 9.5.0

Email Protection Gateway 9.5.0

References

https://github.com/kiteworks/security-advisories/security...
vendor-advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.