CVE-2026-102127— Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference
Quick assessment
Affected
Kiteworks Email Protection Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kiteworks 邮件防护网关所使用的 XML 解析器未对外部实体引用进行限制。当启用某个可选且非默认的消息处理功能时，远程未认证的发送者可能利用精心构造的邮件消息读取网关服务账户可访问的文件（包括加密密钥材料和凭据），并将这些敏感数据发送至其控制的目的地。
Possible ATT&CK Techniques 1 AI
T1566.001 · Spearphishing Attachment
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference
Source: CVE Program / CVE List V5
Vulnerability Description
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kiteworks | Email Protection Gateway | 0 ~ 9.5.1 | - |
|
II. Public POCs for CVE-2026-102127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102127
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-102127 (1)
Other References for CVE-2026-102127 (1)
Same Patch Batch · Kiteworks · 2026-09-30 · 61 CVEs total
| CVE-2026-102115 | 9.8 CRITICAL | Kiteworks Core Authentication Bypass in the Password Reset Workflow |
| CVE-2026-102149 | 9.4 CRITICAL | Kiteworks Email Protection Gateway Improper Access Control |
| CVE-2026-102147 | 9.3 CRITICAL | Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) |
| CVE-2026-102104 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102095 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102102 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102105 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102103 | 9.1 CRITICAL | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102106 | 9.1 CRITICAL | Kiteworks Email Protection Gateway improper authentication |
| CVE-2026-102120 | 8.8 HIGH | Kiteworks Core OS Command Injection |
| CVE-2026-102125 | 8.8 HIGH | Kiteworks Core Sandbox Escape |
| CVE-2026-102092 | 8.7 HIGH | Kiteworks Core stored XSS |
| CVE-2026-102100 | 8.7 HIGH | Kiteworks Core stored XSS |
| CVE-2026-102121 | 8.6 HIGH | Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2026-102126 | 8.1 HIGH | Kiteworks Core Stored Cross-site Scripting (XSS) |
| CVE-2026-102101 | 8.1 HIGH | Kiteworks Core deserialization of untrusted data |
| CVE-2026-102112 | 7.8 HIGH | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102118 | 7.8 HIGH | Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation |
| CVE-2026-102113 | 7.8 HIGH | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102143 | 7.5 HIGH | Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type |
Showing top 20 of 61 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Email Protection Gateway
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication -
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrus -
CVE-2026-102116
Kiteworks Email Protection Gateway Path Traversal -
CVE-2026-102119
Kiteworks Email Protection Gateway Path Traversal
Same vendor: Kiteworks
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication -
CVE-2026-102107
Kiteworks Core user impersonation in a file-request feature -
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrus -
CVE-2026-102109
Kiteworks Secure Data Forms SQL injection
Same weakness: CWE-611
-
CVE-2026-82376
Apache Roller: XML external entity processing in trackback r -
CVE-2026-82386
Apache Roller: XML external entity processing in OPML bookma -
CVE-2026-93030
FortiManager 4.x XML外部实体注入漏洞 -
CVE-2026-61741
http4s-scala-xml has an XML External Entity (XXE) processing -
CVE-2026-81536
DataStage on Cloud Pak for Data has several vulnerabilities
V. Comments for CVE-2026-102127
No comments yet