CVE-2026-102127

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway (affected versions not specified)

Description An XML parser fails to restrict external entity references. When an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender can use a crafted message to read files accessible to the gateway service account, such as credentials and cryptographic key material, and exfiltrate them to a destination under their control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.