CVE-2026-102102: Critical Unauthenticated SSRF in Kiteworks Email Protection Gateway
ID: 844eafd0-d086-56f0-9533-4c716f8e855e
STIX ID: report--844eafd0-d086-56f0-9533-4c716f8e855e
Feed Name: CosmicBytez Labs
Threat Score
Kiteworks Email Protection Gateway (versions before 9.5.0) is affected by CVE-2026-102102, a critical (CVSS 9.1) unauthenticated Server-Side Request Forgery that allows a remote sender to force the gateway to fetch attacker-controlled issuer-certificate URLs during certificate validation; the issue is fixed in 9.5.0 (and consolidated in 9.5.1) and organizations are advised to patch immediately, restrict outbound egress, and enforce cloud metadata protections like IMDSv2.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.