CVE-2026-29092CWE-613

Kiteworks Email Protection Gateway has an Insufficient Session Expiration

Medium · published March 25, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.1th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-03-25T16:59Z
EPSS history
Timeline
  • 25 MAR 16:59Z
    Kiteworks Email Protection Gateway has an Insufficient Session Expiration
    cvelistv5