Server-Side Request Forgery Vulnerability in Kiteworks Email Protection Gateway
CVE-2026-102104

9.1CRITICAL

Key Information:

Vendor

Kiteworks

Status
Email Protection Gateway
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102104?

The Kiteworks Email Protection Gateway prior to version 9.5.0 has a vulnerability that allows remote, unauthorized users to exploit the system through server-side request forgery (SSRF). This weakness can lead to the gateway sending unauthorized requests to internal or unintended network locations when processing online certificate status checks. If exploited, this could potentially disclose sensitive internal information or disrupt the operation of the gateway.

Affected Version(s)

Email Protection Gateway 0 < 9.5.0

Email Protection Gateway 9.5.0

References

https://github.com/kiteworks/security-advisories/security...
vendor-advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.