Description
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.
Affected products
accellion: kiteworks
References2
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 68 · as of 10 November 2026
- CWE
- CWE-94CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.