# CVE-2026-102108: Kiteworks Email Protection Gateway remote code execution in deserialization

Source: https://junglewise.ai/threats/cve-2026-102108-an-authenticated-administrator-of-kiteworks-email-protection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102108 · Severity: high · CVSS 7.2 · Published 2026-09-30

Kiteworks Email Protection Gateway is a security appliance that filters and protects email communications. An authenticated administrator with specific privileges can submit a malicious serialized object to the cluster management interface, leading to arbitrary code execution with the privileges of the gateway service account. This could allow an insider threat or compromised admin account to take complete control of the email security infrastructure.

Technologies: [Kiteworks Email Protection Gateway](https://junglewise.ai/threats/technologies/email-protection-gateway). Vendors: [Kiteworks](https://junglewise.ai/threats/vendors/kiteworks).

## Quick answers

**Is CVE-2026-102108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102108 being exploited in the wild.

**How severe is CVE-2026-102108?** High severity, with a CVSS score of 7.2, published 30 September 2026.

**Which products and versions are affected?** Kiteworks Email Protection Gateway before 9.5.0.

**Is there a fix for CVE-2026-102108?** A patch was published on 2026-09-30: Version 9.5.0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102108 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102108?** Check whether you run Kiteworks Email Protection Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insecure deserialization vulnerability (CWE-502) exists in the cluster management interface where untrusted serialized objects are deserialized without adequate validation. The vulnerability requires network access, an authenticated administrator account, and the target admin must hold a specific queue-management privilege. Successful exploitation results in arbitrary code execution in the context of the gateway service account, and a patch is available in version 9.5.0 and later.

## Affected products

- Kiteworks Email Protection Gateway before 9.5.0

## Timeline

- 2026-09-30: disclosed
- 2026-09-30: patched: Version 9.5.0 and later

## References

- [https://github.com/kiteworks/security-advisories/security/advisories/GHSA-837h-99j2-hxjr](https://github.com/kiteworks/security-advisories/security/advisories/GHSA-837h-99j2-hxjr)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json)

## Related threats

- [Kiteworks Email Protection Gateway improper access control on certificate assignment](https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict)
- [Kiteworks Email Protection Gateway arbitrary file write via template injection](https://junglewise.ai/threats/cve-2026-102146-an-authenticated-email-protection-gateway-administrator-holding)
- [Kiteworks Email Protection Gateway resource exhaustion](https://junglewise.ai/threats/cve-2026-102144-a-resource-exhaustion-vulnerability-in-kiteworks-email)
- [Kiteworks Email Protection Gateway unauthenticated file upload](https://junglewise.ai/threats/cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker)
- [Kiteworks Email Protection Gateway authorization bypass in large file exchange](https://junglewise.ai/threats/cve-2026-102139-an-authorization-check-in-the-large-file-exchange-feature-of)