CVE on X: "CVE-2026

Back X

CVE on X: "CVE-2026

X • October 1, 2026

Share: View original

CVE on X: "CVE-2026-102097 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administ…

CVE-2026-102097 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administ…

CVE-2026-102097 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administ…

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kiteworks Patches Code Injection Vulnerability in Email Protection Gateway Kiteworks has patched a maximum-severity vulnerability (CVE-2026-54154) affecting its Email Protection Gateway (EPG), which could allow unauthenticated remote attackers to execute arbitrary code. The flaw, reported through Kiteworks' bug bounty program, affects all EPG versions prior to 9.4.1. Kiteworks also addressed 126 vulnerabilities in total, including 11 flaws related to authentication bypass and improper access control. The company had previously advised customers to shut down servers due to threat intelligence indicating a potential zero-day attack. However, after applying the patches, they confirmed no evidence of compromise. Another CVE (CVE-2026-102097) was published on September 30, 2026, indicating similar vulnerabilities in EPG versions before 9.5.0. The current status is that all affected systems should be updated to version 9.4.1 or later. 2 sources 61

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CVE-2026-102097

Platforms (1)

Kiteworks Email Protection Gateway