CVE-2026-102106

Summary

The flaw allows an attacker to bypass authentication in the Kiteworks Email Protection Gateway administrative service, enabling them to modify or delete internal users and domains, and change security configurations without proper authorization.

Exploitability

Exploitation is relatively straightforward for an attacker who has access to a valid administrator account, as the password check can be bypassed.

Blast radius

If exploited, this flaw could lead to unauthorized changes to the gateway's configuration, potentially locking out legitimate administrators and compromising the security of managed domains and users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of Kiteworks Email Protection Gateway, as version 2.590 or later addresses this vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.