CVE-2026-54154 CVE-2026-54154
–
Analysis on rafaelpfister.ch
- Article · October 31, 2026 totemomail 9.5.1: Account takeover in the Web Portal and SSRF via incoming email fixed totemomail 9.5.1 fixes eight security vulnerabilities and brings totemomail in line with the Kiteworks advisories for Email Protection Gateway published at the end of September. Two vulnerabilities can be exploited without authentication: a flaw in the Web Portal password reset process that allows administrator accounts to be taken over, and server-side retrieval of URLs from incoming messages. The release also includes path traversal fixes in the Admin API and Mail API, as well as updated Tomcat and Batik libraries.
- Article · September 25, 2026 Kiteworks: Vendor Recommends Shutdown on September 26 – What Is Known So Far Kiteworks asked its customers to shut down all systems on Saturday, September 26, 2026, from 4:00 a.m. to 10:00 a.m. Final report: During the shutdown, the vendor found and closed a critical flaw without a CVE; on September 30, 125 advisories followed, including CVE-2026-54154 (CVSS 10.0) in the Email Protection Gateway. Totemomail is not affected.
