CVE-2026-102094

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0

Description The software is subject to Unsafe Reflection, a condition where an application allows the loading of classes or methods dynamically without sufficient validation. This occurs because the mail-processing pipeline does not adequately restrict the code that can be loaded from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges can exploit this to load and execute arbitrary code outside the approved set of mail-processing components, potentially running within the context of the mail-gateway service account.

Recommendations Update Kiteworks Email Protection Gateway to version 9.5.0 or later.