CVE-2026-102127

Published: Sep 30, 2026Modified: Oct 8, 2026

7.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Exploitability: 2.2 / Impact: 4.7

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.

Affected (1)

Products: Accellion: Kiteworks

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Accellion Kiteworks	version < 9.5.1

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Broken Link

Timeline

No history available yet.