---
id: CVE-2026-102097
title: >-
  Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to
  Remote Code Execution
summary: >-
  Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to
  Remote Code Execution. Kiteworks Email Protection Gateway allowed an
  authenticated administrator to import configuration whose contents were not
  sufficiently valida…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
  - CWE-94
vendor: accellion
product: kiteworks
affected:
  - kiteworks < 9.5.0
patched:
  - kiteworks 9.5.0
published: '2026-09-30'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:43:06.717'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102097'
references:
  - url: >-
      https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
    label: 9119a7d8-5eab-497f-8521-727c672e3725
tags:
  - nvd
  - cve.org
epss: 0.02168
epssPercentile: 0.82171
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T13:25:27.090508Z'
ingestedAt: '2026-09-30T21:25:07.821Z'
---

## Overview

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.

## Affected

- `kiteworks < 9.5.0`

## Remediation

Upgrade past the affected range:

- `kiteworks 9.5.0`