Kiteworks patches max severity code injection vulnerability

Kiteworks has shipped fixes for 126 security issues, among them a maximum-severity vulnerability in its Email Protection Gateway (EPG), a core piece of the company's Private Content Network (PCN) that ties together enterprise email, managed file transfer, file sharing, APIs and web forms. The bug, tracked as CVE-2026-54154 and reported via the vendor's YesWeHack bug bounty program, combines path traversal, code injection and a missing authentication check, letting an unauthenticated attacker remotely execute code and seize full control of an EPG appliance with minimal effort. All EPG releases prior to version 9.4.1 are affected, and version 9.4.1 resolves the issue. Alongside this, Kiteworks also closed 11 other critical bugs in its Core and EPG modules, including authentication bypass, admin account takeover, stored XSS and access-control flaws. The disclosure follows last week's emergency six-hour shutdown Kiteworks ordered for customers over fears of an imminent zero-day attack—an incident the company says left no sign of actual compromise, though it has not yet detailed or assigned a CVE to that separate flaw. Shadowserver currently counts close to 400 internet-exposed Kiteworks instances, a platform used by thousands of organizations and over 100 million end users, underscoring the urgency for admins to apply the update.