CVE-2026-102127

7 HIGHpublic exploit available

Published 2026-09-30 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses

CWE-611

Public exploit & PoC references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84

All references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-10025
MEDIUMCVE-2026-101893
HIGHCVE-2026-102155
HIGHCVE-2026-106616
HIGHCVE-2026-109430
MEDIUMCVE-2026-14304PoC
HIGHCVE-2026-14905
HIGHCVE-2026-17646

Related by shared AI tags and CWE weakness class. Browse the full archive.