CVE-2026-102094— Kiteworks Email Protection Gateway unsafe reflection
Quick assessment
Affected
Kiteworks Email Protection Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kiteworks 邮件防护网关在 9.5.0 版本之前存在不安全反射（Unsafe Reflection）漏洞，未能充分限制邮件处理流水线从导入的规则配置中加载的代码。拥有邮件规则配置权限的已认证管理员可诱导网关加载并执行超出批准范围的邮件处理组件代码，且该执行可能发生在邮件网关服务账户的上下文中。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102094
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiteworks Email Protection Gateway unsafe reflection
Source: CVE Program / CVE List V5
Vulnerability Description
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kiteworks | Email Protection Gateway | 0 ~ 9.5.0 | - |
|
II. Public POCs for CVE-2026-102094
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102094
请登录查看更多情报信息。
Other References for CVE-2026-102094 (2)
Same Patch Batch · Kiteworks · 2026-09-30 · 61 CVEs total
| CVE-2026-102115 | 9.8 CRITICAL | Kiteworks Core Authentication Bypass in the Password Reset Workflow |
| CVE-2026-102149 | 9.4 CRITICAL | Kiteworks Email Protection Gateway Improper Access Control |
| CVE-2026-102147 | 9.3 CRITICAL | Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) |
| CVE-2026-102105 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102102 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102095 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102104 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102103 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102106 | 9.1 CRITICAL | Kiteworks Email Protection Gateway improper authentication |
| CVE-2026-102125 | 8.8 HIGH | Kiteworks Core Sandbox Escape |
| CVE-2026-102120 | 8.8 HIGH | Kiteworks Core OS Command Injection |
| CVE-2026-102092 | 8.7 HIGH | Kiteworks Core stored XSS |
| CVE-2026-102100 | 8.7 HIGH | Kiteworks Core stored XSS |
| CVE-2026-102121 | 8.6 HIGH | Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2026-102101 | 8.1 HIGH | Kiteworks Core deserialization of untrusted data |
| CVE-2026-102126 | 8.1 HIGH | Kiteworks Core Stored Cross-site Scripting (XSS) |
| CVE-2026-102113 | 7.8 HIGH | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102112 | 7.8 HIGH | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102118 | 7.8 HIGH | Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation |
| CVE-2026-102128 | 7.5 HIGH | Kiteworks Email Protection Gateway Improper Authentication |
Showing top 20 of 61 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Email Protection Gateway
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication -
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrus -
CVE-2026-102116
Kiteworks Email Protection Gateway Path Traversal -
CVE-2026-102119
Kiteworks Email Protection Gateway Path Traversal
Same vendor: Kiteworks
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication -
CVE-2026-102107
Kiteworks Core user impersonation in a file-request feature -
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrus -
CVE-2026-102109
Kiteworks Secure Data Forms SQL injection
Same weakness: CWE-470
-
CVE-2026-102580
Moodle: arbitrary class instantiation via report builder aud -
CVE-2026-96740
Streamshub/console: console-operator: streams for apache kaf -
CVE-2026-101292
Artemis-core-client: unsafe reflection in apache activemq ar -
CVE-2026-96672
Frappe ERPNext before 16.34.1 Unauthorized Method Invocation -
CVE-2026-18123
IBM Financial Transaction Manager (FTM) is Impacted by Multi
V. Comments for CVE-2026-102094
No comments yet