CVE-2026-102131CWE-178CWE-94code-injection

CVE-2026-102131

High · published October 1, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.6th percentile
Weaknesses
CWE-178 · Improper Handling of Case Sensitivity; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-01T01:17Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.09.5.0
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-62f6-c955-4fhq · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 20:13Z
    Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity
    cvelistv5