PT-2026-103535

CVE-2026-102097

Published

2026-09-30

Updated

2026-10-01

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0

Description An authenticated administrator can achieve Remote Code Execution by importing a configuration with contents that are not sufficiently validated before processing. A crafted submission allows the execution of arbitrary commands on the gateway.

Recommendations Update Kiteworks Email Protection Gateway to version 9.5.0 or later.

Exploitability

Fix

Impacts

Researchers

Icare

Truff

Wlayzz

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')