{"schema_version":1,"title":"Kiteworks Email Protection Gateway vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 22 vulnerabilities in Kiteworks Email Protection Gateway: 0 in the last 7 days and 22 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102149, was published on 30 September 2026. Nothing in the last four weeks, down from 22 vulnerabilities in the four before. 0 critical against 7.","url":"https://junglewise.ai/threats/technologies/email-protection-gateway","json_url":"https://junglewise.ai/threats/technologies/email-protection-gateway.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/email-protection-gateway","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":11,"all_time":22,"critical":7,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":22,"last_365_days":22},"latest":[{"cve":"CVE-2026-102149","cvss":9.4,"slug":"cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict","title":"Kiteworks Email Protection Gateway improper access control on certificate assignment","severity":"critical","exploited":false,"published_at":"2026-09-30T21:17:03.76+00:00","url":"https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict"},{"cve":"CVE-2026-102146","cvss":6.5,"slug":"cve-2026-102146-an-authenticated-email-protection-gateway-administrator-holding","title":"Kiteworks Email Protection Gateway arbitrary file write via template injection","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:03.51+00:00","url":"https://junglewise.ai/threats/cve-2026-102146-an-authenticated-email-protection-gateway-administrator-holding"},{"cve":"CVE-2026-102144","cvss":5.3,"slug":"cve-2026-102144-a-resource-exhaustion-vulnerability-in-kiteworks-email","title":"Kiteworks Email Protection Gateway resource exhaustion","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:03.267+00:00","url":"https://junglewise.ai/threats/cve-2026-102144-a-resource-exhaustion-vulnerability-in-kiteworks-email"},{"cve":"CVE-2026-102143","cvss":7.5,"slug":"cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker","title":"Kiteworks Email Protection Gateway unauthenticated file upload","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:03.143+00:00","url":"https://junglewise.ai/threats/cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker"},{"cve":"CVE-2026-102139","cvss":6.5,"slug":"cve-2026-102139-an-authorization-check-in-the-large-file-exchange-feature-of","title":"Kiteworks Email Protection Gateway authorization bypass in large file exchange","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.663+00:00","url":"https://junglewise.ai/threats/cve-2026-102139-an-authorization-check-in-the-large-file-exchange-feature-of"},{"cve":"CVE-2026-102135","cvss":6.6,"slug":"cve-2026-102135-on-a-kiteworks-email-protection-gateway-cluster-with-database","title":"Kiteworks Email Protection Gateway deserialization of untrusted data","severity":"medium","exploited":false,"published_at":"2026-09-30T21:17:02.157+00:00","url":"https://junglewise.ai/threats/cve-2026-102135-on-a-kiteworks-email-protection-gateway-cluster-with-database"},{"cve":"CVE-2026-102131","cvss":7.2,"slug":"cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain","title":"Kiteworks Email Protection Gateway code injection via case sensitivity bypass","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.667+00:00","url":"https://junglewise.ai/threats/cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain"},{"cve":"CVE-2026-102130","cvss":7.2,"slug":"cve-2026-102130-kiteworks-email-protection-gateway-did-not-sufficiently-validate","title":"Kiteworks Email Protection Gateway arbitrary code execution in backup validation","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.533+00:00","url":"https://junglewise.ai/threats/cve-2026-102130-kiteworks-email-protection-gateway-did-not-sufficiently-validate"},{"cve":"CVE-2026-102128","cvss":7.5,"slug":"cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection","title":"Kiteworks Email Protection Gateway improper authentication","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.27+00:00","url":"https://junglewise.ai/threats/cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection"},{"cve":"CVE-2026-102127","cvss":7,"slug":"cve-2026-102127-an-xml-parser-used-by-kiteworks-email-protection-gateway-did-not","title":"Kiteworks Email Protection Gateway XXE in XML parser","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.117+00:00","url":"https://junglewise.ai/threats/cve-2026-102127-an-xml-parser-used-by-kiteworks-email-protection-gateway-did-not"},{"cve":"CVE-2026-102119","cvss":7.2,"slug":"cve-2026-102119-a-path-traversal-weakness-in-an-optional-non-default","title":"Kiteworks Email Protection Gateway path traversal in administrative feature","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:59.9+00:00","url":"https://junglewise.ai/threats/cve-2026-102119-a-path-traversal-weakness-in-an-optional-non-default"},{"cve":"CVE-2026-102116","cvss":7.2,"slug":"cve-2026-102116-a-weakness-could-have-allowed-an-authenticated-kiteworks-email","title":"Kiteworks Email Protection Gateway path traversal RCE","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:59.36+00:00","url":"https://junglewise.ai/threats/cve-2026-102116-a-weakness-could-have-allowed-an-authenticated-kiteworks-email"},{"cve":"CVE-2026-102108","cvss":7.2,"slug":"cve-2026-102108-an-authenticated-administrator-of-kiteworks-email-protection","title":"Kiteworks Email Protection Gateway remote code execution in deserialization","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:57.737+00:00","url":"https://junglewise.ai/threats/cve-2026-102108-an-authenticated-administrator-of-kiteworks-email-protection"},{"cve":"CVE-2026-102106","cvss":9.1,"slug":"cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway","title":"Kiteworks Email Protection Gateway auth bypass in administrative service","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.49+00:00","url":"https://junglewise.ai/threats/cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway"},{"cve":"CVE-2026-102105","cvss":9.1,"slug":"cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway SSRF","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.37+00:00","url":"https://junglewise.ai/threats/cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102104","cvss":9.1,"slug":"cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway server-side request forgery","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.25+00:00","url":"https://junglewise.ai/threats/cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102103","cvss":9.1,"slug":"cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway SSRF in certificate revocation list handling","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.127+00:00","url":"https://junglewise.ai/threats/cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102102","cvss":9.1,"slug":"cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway Server-Side Request Forgery","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57+00:00","url":"https://junglewise.ai/threats/cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102097","cvss":7.2,"slug":"cve-2026-102097-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway remote code execution in configuration import","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:56.37+00:00","url":"https://junglewise.ai/threats/cve-2026-102097-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102095","cvss":9.1,"slug":"cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway server-side request forgery","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:56.12+00:00","url":"https://junglewise.ai/threats/cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102094","cvss":7.2,"slug":"cve-2026-102094-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway unsafe reflection in mail-rule configuration","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:55.99+00:00","url":"https://junglewise.ai/threats/cve-2026-102094-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102089","cvss":7.2,"slug":"cve-2026-102089-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway path traversal in administrative import","severity":"high","exploited":false,"published_at":"2026-09-30T21:16:55.35+00:00","url":"https://junglewise.ai/threats/cve-2026-102089-kiteworks-email-protection-gateway-before-version-9-5-0-is"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":7,"exploited":0,"vulnerabilities":22},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Kiteworks Core","slug":"kiteworks-core","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/kiteworks-core"},{"name":"Kiteworks Secure Data Forms","slug":"secure-data-forms","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/secure-data-forms"},{"name":"Kiteworks Kite","slug":"kite","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/kite"}],"technology":{"hub":true,"name":"Kiteworks Email Protection Gateway","slug":"email-protection-gateway","vendor":{"hub":true,"name":"Kiteworks","slug":"kiteworks","url":"https://junglewise.ai/threats/vendors/kiteworks"},"aliases":[],"category":"appliance","description":"Kiteworks Email Protection Gateway is an appliance for secure email communication and threat prevention.","url":"https://junglewise.ai/threats/technologies/email-protection-gateway"},"most_severe":[{"cve":"CVE-2026-102149","cvss":9.4,"slug":"cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict","title":"Kiteworks Email Protection Gateway improper access control on certificate assignment","severity":"critical","exploited":false,"published_at":"2026-09-30T21:17:03.76+00:00","url":"https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict"},{"cve":"CVE-2026-102106","cvss":9.1,"slug":"cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway","title":"Kiteworks Email Protection Gateway auth bypass in administrative service","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.49+00:00","url":"https://junglewise.ai/threats/cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway"},{"cve":"CVE-2026-102105","cvss":9.1,"slug":"cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway SSRF","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.37+00:00","url":"https://junglewise.ai/threats/cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102104","cvss":9.1,"slug":"cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway server-side request forgery","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.25+00:00","url":"https://junglewise.ai/threats/cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102103","cvss":9.1,"slug":"cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway SSRF in certificate revocation list handling","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.127+00:00","url":"https://junglewise.ai/threats/cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102102","cvss":9.1,"slug":"cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway Server-Side Request Forgery","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57+00:00","url":"https://junglewise.ai/threats/cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102095","cvss":9.1,"slug":"cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway server-side request forgery","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:56.12+00:00","url":"https://junglewise.ai/threats/cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is"},{"cve":"CVE-2026-102143","cvss":7.5,"slug":"cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker","title":"Kiteworks Email Protection Gateway unauthenticated file upload","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:03.143+00:00","url":"https://junglewise.ai/threats/cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker"},{"cve":"CVE-2026-102128","cvss":7.5,"slug":"cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection","title":"Kiteworks Email Protection Gateway improper authentication","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.27+00:00","url":"https://junglewise.ai/threats/cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection"},{"cve":"CVE-2026-102131","cvss":7.2,"slug":"cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain","title":"Kiteworks Email Protection Gateway code injection via case sensitivity bypass","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:01.667+00:00","url":"https://junglewise.ai/threats/cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}