# Kiteworks Email Protection Gateway vulnerabilities Source: https://junglewise.ai/threats/technologies/email-protection-gateway Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/email-protection-gateway.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in Kiteworks Email Protection Gateway: 0 in the last 7 days and 22 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102149, was published on 30 September 2026. Nothing in the last four weeks, down from 22 vulnerabilities in the four before. 0 critical against 7. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 22 - All time: 22 (7 critical, 0 exploited in the wild) ## About Kiteworks Email Protection Gateway Kiteworks Email Protection Gateway is an appliance for secure email communication and threat prevention. ## Latest Kiteworks Email Protection Gateway vulnerabilities - [CVE-2026-102149: Kiteworks Email Protection Gateway improper access control on certificate assignment](https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict) (critical, CVSS 9.4, published 30 Sep 2026) - [CVE-2026-102146: Kiteworks Email Protection Gateway arbitrary file write via template injection](https://junglewise.ai/threats/cve-2026-102146-an-authenticated-email-protection-gateway-administrator-holding) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-102144: Kiteworks Email Protection Gateway resource exhaustion](https://junglewise.ai/threats/cve-2026-102144-a-resource-exhaustion-vulnerability-in-kiteworks-email) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-102143: Kiteworks Email Protection Gateway unauthenticated file upload](https://junglewise.ai/threats/cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-102139: Kiteworks Email Protection Gateway authorization bypass in large file exchange](https://junglewise.ai/threats/cve-2026-102139-an-authorization-check-in-the-large-file-exchange-feature-of) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-102135: Kiteworks Email Protection Gateway deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-102135-on-a-kiteworks-email-protection-gateway-cluster-with-database) (medium, CVSS 6.6, published 30 Sep 2026) - [CVE-2026-102131: Kiteworks Email Protection Gateway code injection via case sensitivity bypass](https://junglewise.ai/threats/cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102130: Kiteworks Email Protection Gateway arbitrary code execution in backup validation](https://junglewise.ai/threats/cve-2026-102130-kiteworks-email-protection-gateway-did-not-sufficiently-validate) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102128: Kiteworks Email Protection Gateway improper authentication](https://junglewise.ai/threats/cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-102127: Kiteworks Email Protection Gateway XXE in XML parser](https://junglewise.ai/threats/cve-2026-102127-an-xml-parser-used-by-kiteworks-email-protection-gateway-did-not) (high, CVSS 7, published 30 Sep 2026) - [CVE-2026-102119: Kiteworks Email Protection Gateway path traversal in administrative feature](https://junglewise.ai/threats/cve-2026-102119-a-path-traversal-weakness-in-an-optional-non-default) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102116: Kiteworks Email Protection Gateway path traversal RCE](https://junglewise.ai/threats/cve-2026-102116-a-weakness-could-have-allowed-an-authenticated-kiteworks-email) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102108: Kiteworks Email Protection Gateway remote code execution in deserialization](https://junglewise.ai/threats/cve-2026-102108-an-authenticated-administrator-of-kiteworks-email-protection) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102106: Kiteworks Email Protection Gateway auth bypass in administrative service](https://junglewise.ai/threats/cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102105: Kiteworks Email Protection Gateway SSRF](https://junglewise.ai/threats/cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102104: Kiteworks Email Protection Gateway server-side request forgery](https://junglewise.ai/threats/cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102103: Kiteworks Email Protection Gateway SSRF in certificate revocation list handling](https://junglewise.ai/threats/cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102102: Kiteworks Email Protection Gateway Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102097: Kiteworks Email Protection Gateway remote code execution in configuration import](https://junglewise.ai/threats/cve-2026-102097-kiteworks-email-protection-gateway-before-version-9-5-0-is) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102095: Kiteworks Email Protection Gateway server-side request forgery](https://junglewise.ai/threats/cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102094: Kiteworks Email Protection Gateway unsafe reflection in mail-rule configuration](https://junglewise.ai/threats/cve-2026-102094-kiteworks-email-protection-gateway-before-version-9-5-0-is) (high, CVSS 7.2, published 30 Sep 2026) - [CVE-2026-102089: Kiteworks Email Protection Gateway path traversal in administrative import](https://junglewise.ai/threats/cve-2026-102089-kiteworks-email-protection-gateway-before-version-9-5-0-is) (high, CVSS 7.2, published 30 Sep 2026) ## Most severe Kiteworks Email Protection Gateway vulnerabilities - [CVE-2026-102149: Kiteworks Email Protection Gateway improper access control on certificate assignment](https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict) (critical, CVSS 9.4, published 30 Sep 2026) - [CVE-2026-102106: Kiteworks Email Protection Gateway auth bypass in administrative service](https://junglewise.ai/threats/cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102105: Kiteworks Email Protection Gateway SSRF](https://junglewise.ai/threats/cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102104: Kiteworks Email Protection Gateway server-side request forgery](https://junglewise.ai/threats/cve-2026-102104-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102103: Kiteworks Email Protection Gateway SSRF in certificate revocation list handling](https://junglewise.ai/threats/cve-2026-102103-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102102: Kiteworks Email Protection Gateway Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-102102-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102095: Kiteworks Email Protection Gateway server-side request forgery](https://junglewise.ai/threats/cve-2026-102095-kiteworks-email-protection-gateway-before-version-9-5-0-is) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-102143: Kiteworks Email Protection Gateway unauthenticated file upload](https://junglewise.ai/threats/cve-2026-102143-an-unauthenticated-attacker-could-cause-a-file-with-attacker) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-102128: Kiteworks Email Protection Gateway improper authentication](https://junglewise.ai/threats/cve-2026-102128-an-identity-verification-weakness-in-kiteworks-email-protection) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-102131: Kiteworks Email Protection Gateway code injection via case sensitivity bypass](https://junglewise.ai/threats/cve-2026-102131-kiteworks-email-protection-gateway-rejected-certain) (high, CVSS 7.2, published 30 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 22 vulnerabilities in the four before. 0 critical against 7. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 22 | 7 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Kiteworks technologies - [Kiteworks Core](https://junglewise.ai/threats/technologies/kiteworks-core): 33 vulnerabilities - [Kiteworks Secure Data Forms](https://junglewise.ai/threats/technologies/secure-data-forms): 13 vulnerabilities - [Kiteworks Kite](https://junglewise.ai/threats/technologies/kite): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Kiteworks Email Protection Gateway vulnerabilities", https://junglewise.ai/threats/technologies/email-protection-gateway, 9 November 2026.