CVE-2026-102103

Think of your email gateway as a mail clerk who checks the sender's ID before letting mail in. This flaw tricks the clerk into stepping away from the front desk and wandering into back offices it was never supposed to enter — just by sending it a crafted email. An attacker can use this to peek at or disrupt systems inside your network without ever logging in.

This matters to you if you run Kiteworks Email Protection Gateway to filter or secure incoming email. Any gateway processing inbound mail is exposed by default, since no attacker login or special conditions are needed — if your gateway accepts mail from the internet, it is reachable.

This is a critical, remotely exploitable flaw that requires no login and no user action, making it an easy target once attackers turn their attention to it — and security researchers report rising interest tied to a known threat actor group. There is no confirmed active exploitation yet, but given the severity and ease of attack, treat this as something to fix now, not later.

Confirm exposure by checking the gateway's version and whether it is internet-facing for inbound mail processing (the default configuration is reachable). Upgrade to Kiteworks Email Protection Gateway 9.5.0 or 9.5.1, both confirmed fixed by the vendor; review vendor release notes at the linked advisory for any configuration changes tied to certificate revocation list handling. There is no documented workaround to disable the vulnerable certificate revocation check without a patch, so prioritize upgrading over mitigating controls. No CISA KEV listing exists yet, so there is no mandated federal remediation deadline, but given the unauthenticated, network-reachable nature of the flaw and rising threat-actor interest, treat it with KEV-level urgency internally. Monitor vendor advisories for confirmation of exploitation and watch outbound/internal network logs from the gateway for unexpected internal destination requests post-patch.

CVSS 9.1 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H — no privileges or user interaction required, network attack vector, high confidentiality and availability impact. Weakness is CWE-918 (Server-Side Request Forgery), triggered during CRL (certificate revocation list) retrieval while processing inbound email. Not listed in CISA KEV; no dated press confirmation of active exploitation; no public exploit code identified. EPSS places likelihood of near-term exploitation in the lower percentile with a flat trend, though this should be weighed against the vulnerability's critical severity and rising press/threat-actor attention (ShinyHunters) rather than relied on alone. Exploit maturity: theoretical/PoC-stage, no confirmed weaponization.