Kiteworks EPG 9.5.1: Four publicly documented security fixes

Kiteworks continues the former totemo technology as Email Protection Gateway (EPG). Version 9.5.1 was the current Kiteworks version no later than September 25, 2026; the vendor does not state a public release date. The vendor advisories published on September 30 document four fixes for EPG 9.5.1: an account takeover, two unauthenticated flaws for writing files and triggering a denial of service, respectively, and a flaw that allowed administrators to write arbitrary files. The classification for the identically named totemomail version is available in the article on totemomail 9.5.1.

Versions at a glance

Security fixes in 9.5.1

According to Kiteworks, all four advisories affect all EPG versions before 9.5.1 and list 9.5.1 as the fixed version. The advisories were published on September 30, 2026. They retrospectively describe the security status of the release, rather than its exact release date.

• CVE-2026-102149, CVSS 9.4 (critical): A weakness in access control could allow an attacker to gain access to user accounts over the network. The CVSS rating requires neither privileges nor user interaction. Kiteworks classifies the cause as CWE-306 (missing authentication for critical functions) and CWE-639 (authorization bypass through a user-controlled key).
• CVE-2026-102143, CVSS 7.5 (high): An unauthenticated attacker could write files to the appliance. Kiteworks cites an authentication issue as well as CWE-306 and CWE-434 (unrestricted upload of dangerous file types).
• CVE-2026-102146, CVSS 6.5 (medium): An administrator could write arbitrary files. Kiteworks describes a privilege issue; the CVSS metric requires high privileges. The vendor lists CWE-73 (external control of file name or path) and CWE-1336 (insufficient neutralization in a template engine) as weaknesses.
• CVE-2026-102144, CVSS 5.3 (medium): An attacker on the network could trigger a denial of service. The advisory cites missing authentication for critical functions and uncontrolled resource consumption (CWE-306, CWE-400). This rating also requires neither privileges nor user interaction.

For operators, the account takeover is the priority fix because, according to the advisory, it is possible without an existing account. The other two flaws that do not require login also affect all versions before 9.5.1. The vendor advisories do not disclose technical details about endpoints, configurations, or workarounds.

Recommended approach

Upgrade EPG to at least 9.5.1 if an older version is in use. Kiteworks explicitly identifies upgrading to 9.5.1 or later as the remedy for all four advisories. If a later vendor version has already been approved, it also meets this minimum version requirement. Kiteworks has not published a public update path, known issues, or support timelines for EPG 9.5.1 in the sources reviewed.