CVE-2026-102127 — Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a rem…
Published: 2026-09-30 · CVSS: 7.0 · CVSS 3.1
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7