CVE-2026-102130CWE-434CWE-94unrestricted-file-uploadcode-injection

CVE-2026-102130

High · published October 1, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.6th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-01T01:17Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.19.5.1
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m92m-q8cf-rcch · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 20:13Z
    Kiteworks Email Protection Gateway Remote Code Execution
    cvelistv5