CVE-2026-102135 — Kiteworks Email Protection Gateway Deserialization of Untrusted Data
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized …
Published: 2026-09-30 · CVSS: 6.6 · CVSS 3.1
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7