CVE-2026-102106

Think of this like a security guard who's supposed to check ID and a password before letting someone into the server room — but if you just say the right name, the guard waves you in without checking the password at all. Once inside, that person can add or delete employee accounts, change the mail domains the system protects, or lock the real administrators out entirely.

This matters to you if you run Kiteworks Email Protection Gateway to secure or route your business email. The attacker doesn't need a password — they only need to reference a valid administrator account — so this is a risk wherever the administrative service is reachable over the network.

This is a critical-severity flaw (9.1 of 10) that lets an attacker fully bypass admin authentication with no password and no user interaction — that combination makes it a prime target for opportunistic attackers. There's active press attention tying this disclosure to a known data-theft actor group, so even without confirmed in-the-wild exploitation yet, the risk profile is high enough to act immediately rather than wait.

1. Inventory all Kiteworks Email Protection Gateway instances and confirm current version. 2. Any version prior to 9.5.0 is vulnerable; the vendor confirms fixes in both 9.5.0 and 9.5.1 — target the latest available (9.5.1). 3. Apply the vendor's precautionary shutdown/remediation guidance referenced in their press release if you cannot patch immediately — this includes isolating the administrative interface from untrusted networks. 4. After upgrading, audit admin account lists, managed domain configurations, and security-feature settings for unauthorized changes made before the patch, since the flaw allows creation/deletion of users and domains. 5. Not in CISA KEV and no public exploit code exists yet, so there is no mandated remediation deadline — but given the CVSS 9.1 rating, unauthenticated network vector, and press attention linking this disclosure to the ShinyHunters actor, treat this with KEV-level urgency internally. 6. Monitor Kiteworks advisories and vendor press releases for updates, and watch admin audit logs for anomalous configuration or domain-deletion activity post-patch.

CVSS 3.1 score 9.1 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, high integrity and availability impact. Weakness is CWE-287 (Improper Authentication): the administrative service does not consistently enforce the password check when a valid admin account reference is supplied, enabling full bypass. Not listed in CISA KEV; no confirmed in-the-wild exploitation reported in press, and no public exploit code is known to exist. Exploit prediction scoring places likelihood in the 29th percentile with a flat trend, indicating currently low observed attacker interest at scale, though a press roundup links this disclosure to the ShinyHunters actor group, warranting close monitoring. Fixed in versions 9.5.0 and 9.5.1 per vendor advisory.