CVE-2026-102128

Summary

The Kiteworks Email Protection Gateway has a flawed authentication mechanism that allows unauthenticated attackers to impersonate users and create platform accounts without proper verification. This creates a critical risk of unauthorized account access and privilege escalation.

Exploitability

Exploitation requires sending specially crafted email messages to the gateway, but no authentication is needed to trigger the account provisioning or impersonation functionality, making it moderately difficult to exploit with a remote attack vector.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control over user accounts and potentially escalate privileges across the Kiteworks platform, affecting multiple users and their data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected email protection gateway functionality until a patch is available, or restrict access to the gateway endpoint to known trusted IP ranges.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.