CVE-2026-102104

Summary

The flaw allows a remote, unauthenticated attacker to induce the gateway to make requests to internal network destinations, potentially disclosing sensitive information or disrupting operations.

Exploitability

Exploitation is relatively straightforward as it requires crafting specific requests during the online certificate status check process. The attacker must be able to send an inbound message to the gateway.

Blast radius

If exploited, this could lead to the disclosure of sensitive internal information or disruption of the gateway's operation, impacting internal network security and availability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Kiteworks Email Protection Gateway version 9.5.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.