Kiteworks Email Protection Gateway: Server-Side Request Forgery (SSRF)
Summary
Kiteworks Email Protection Gateway (EPG) before version 9.5.0 contains a server-side request forgery flaw in how it fetches external resources while rendering message content. A remote, unauthenticated attacker can induce the gateway to send crafted requests to internal or unintended network destinations. Depending on which services are reachable from the gateway, this may disclose sensitive internal information or trigger unintended actions on internal systems. The CVSS vector indicates impact on confidentiality and integrity.
Affected
- Kiteworks Email Protection Gateway, all versions before 9.5.0
Fixed in
- Upgrade to 9.5.0 or later (vendor remediation)
- Kiteworks names 9.5.1 as its current release; target 9.5.1 or later
Workaround
- No vendor-documented workaround found.
- Generic measure until patched: restrict outbound connections from the gateway to internal subnets and cloud metadata addresses (egress filtering). This is not vendor-confirmed.
Exploitation
- No public proof of concept or confirmed in-the-wild exploitation found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- KEV status not verified; one aggregator lists it as not in KEV.
Our recommendation
- Inventory all EPG instances, including version and hosting model.
- Upgrade to 9.5.1 or later; 9.5.0 is the minimum vendor fix.
- Restrict outbound connections from EPG to internal networks and metadata endpoints until patched.
- Review EPG logs since late September for unusual outbound requests from the gateway.
- Review all EPG advisories published on 30 September 2026, as related critical flaws exist.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kiteworks GitHub Security Advisory GHSA-hq47-4whq-9hgv github.com
- CISA CSAF advisory va-26-274-01 raw.githubusercontent.com
- CVE record CVE-2026-102105 (cvelistV5) raw.githubusercontent.com
- VulDB CVE-2026-102105 vuldb.com
- Kiteworks precautionary shutdown advisory press release www.kiteworks.com
- Kiteworks 12.5 advisories overview (pk-sharma) www.pk-sharma.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:52.
Original description (NVD)
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.