CVE-2026-102105 Kiteworks Email Protection Gateway server-side request forgery

Beschreibung des Herstellers (englisch)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems.

Stammdaten

Hersteller

Kiteworks

Betroffene Produkte

• Email Protection Gateway

CVSS 3.1

9.1 (CRITICAL)

Vektor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Schwachstellentyp

CWE-918: Server-Side Request Forgery

Veröffentlicht

30. September 2026

Offizielle Quellen

• CVE.org
• NVD
• Hersteller-Advisory

← Alle Schwachstellen