CVE-2026-102102

Think of your email gateway as a mail clerk who only ever opens envelopes and sorts mail. This flaw tricks the clerk into also making phone calls into secure back-offices on an attacker's behalf, just by sending the clerk a specially crafted letter. No one needs a key or password to make this happen.

This matters to you if you run the Kiteworks Email Protection Gateway, a mail security appliance used to filter and manage inbound/outbound business email. Because the flaw is triggered automatically during normal inbound mail processing, it is a risk for any organization running an unpatched gateway that can receive email from the internet — no attacker login or special access is needed.

This is rated highest severity because any internet-facing gateway can be attacked over the network with no credentials and no user clicking anything — the gateway itself does the damage while processing routine incoming mail. There is no confirmed active exploitation or public exploit code yet, but the ease of attack (no authentication, fully remote) and the critical severity score mean this should be treated as a priority to patch immediately rather than wait for signs of attack.

Confirm your running version via the Kiteworks admin console or support channel; any version prior to 9.5.0 is vulnerable. Upgrade to 9.5.0 or the later 9.5.1 release referenced in vendor advisories — review the vendor's release/upgrade notes for any configuration migration steps specific to your deployment. If immediate patching isn't possible, restrict the gateway's outbound network access (egress filtering/firewall rules) to only the destinations it legitimately needs, particularly blocking access to internal management interfaces, cloud metadata endpoints, and other sensitive internal services, since SSRF impact depends on what's reachable from the gateway. There is no CISA KEV listing or due date for this CVE at this time. Monitor outbound connection logs from the gateway for unexpected internal destination requests, and watch vendor/security feeds for any update on exploitation status given the current press attention around related email/network gateway 0-days.

CVSS 3.1 score 9.1 (Critical: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) reflects network-exploitable, low-complexity, no-privilege SSRF with high confidentiality and availability impact and no integrity impact. The weakness (CWE-918, Server-Side Request Forgery) is triggered during issuer-certificate retrieval while processing inbound email. Not in CISA KEV; no public exploit code identified; press reporting does not confirm exploitation of this specific CVE (coverage references unrelated CVE-2026-88779 and general industry roundups). EPSS places predicted exploitation likelihood in the lower range with a flat trend, consistent with no observed in-the-wild activity yet. Exploit maturity: theoretical/PoC-absent at this time; urgency is driven by severity and attack simplicity rather than confirmed exploitation.