CVE-2026-102108 — Kiteworks Email Protection Gateway deserialization of untrusted data
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without suf…
Published: 2026-09-30 · CVSS: 7.2 · CVSS 3.1
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7