EUVD Vulnerability Catalog

EUVD-2026-90282

Severity: CRITICAL Base Score: 9.1 CVSS Version: 3.1

Vulnerability Description

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves an issuer certificate in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Scope (S): Unchanged

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): None

▪ Availability Impact (A): High

Affected Vendors & Systems

Vendor Kiteworks

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

cisa-cg

EPSS Probability

Known Aliases

CVE-2026-102102

Published On

2026-09-30

Last Updated

2026-10-01