CVE-2026-102095

Think of this gateway as a mail clerk who normally only delivers letters between you and the outside world. This flaw lets a stranger hand the clerk a fake address and have them walk into your private back offices to fetch information — without ever showing ID. That's dangerous because those back offices were never meant to be reachable from outside.

This matters to you if you run Kiteworks Email Protection Gateway for secure email or file exchange. The flaw works over the network with no login required, so any instance reachable over the internet is at risk regardless of user accounts.

This is rated critical because any unauthenticated attacker over the network can abuse it to reach internal systems, and press attention is rising with a known data-theft actor (ShinyHunters) linked to the coverage. There is no confirmed active exploitation yet and no public exploit code, but the combination of severity, no login requirement, and attacker interest means you should not wait — patch now rather than monitor and see.

1. Inventory all Kiteworks Email Protection Gateway instances and record current version. 2. Confirm network exposure — is the gateway's admin or request-handling interface reachable from the public internet or only internally? SSRF risk is highest for internet-facing deployments. 3. Upgrade to 9.5.0 (or 9.5.1, the latest fixed release) — follow Kiteworks' release notes for any migration steps between your current version and 9.5.x. 4. There is no documented workaround; if immediate upgrade isn't possible, restrict network egress from the gateway host to only required destinations and place a WAF/proxy in front to filter suspicious URL parameters as a stopgap. 5. Not in CISA KEV at this time, so there is no federal remediation deadline, but given the CVSS 9.1 score and unauthenticated network vector, treat this with the same priority as a KEV-listed item. 6. Monitor gateway logs for anomalous outbound requests to internal/private IP ranges (e.g., 169.254.x.x, 10.x.x.x, 192.168.x.x) both before and after patching.

CVSS 3.1 score 9.1 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-exploitable, no privileges or user interaction required, high confidentiality and integrity impact, no availability impact. Weakness is CWE-918 (Server-Side Request Forgery). EPSS places predicted near-term exploitation likelihood in the lower range with a flat trend, and the CVE is not currently listed in CISA KEV; no dated news confirmation of in-the-wild exploitation and no public exploit code exist yet, so exploitation should be treated as unconfirmed but plausible given the low attack complexity and rising press attention referencing the ShinyHunters actor. Fixed in versions 9.5.0 and 9.5.1.