A Server‑Side Request Forgery vulnerability exists in Kiteworks Email Protection Gateway before version 9.5.0, allowing a remote, unauthenticated attacker to force the gateway to issue requests to unintended internal network destinations. The flaw is triggered during an online certificate status check for inbound messages, giving an attacker the ability to retrieve internal data or disrupt service with crafted requests.

Affected systems are Kiteworks Email Protection Gateway deployments running any release prior to version 9.5.0, including all 9.4.x and earlier builds. Versions 9.5.0 and later contain the fix and are no longer vulnerable.

The SSRF weakness can be exploited by an adversary who can submit a specially crafted inbound message. Because authentication is not required, the attack can originate from anywhere on the Internet, and the gateway will query internal endpoints, potentially exposing sensitive information or causing denial of service. The CVSS score of 9.1 reflects a critical risk. No EPSS data is available, but the lack of an authentication barrier means exploitation likelihood remains high. The vulnerability is not currently listed in the CISA KEV catalog, yet the severity and ease of exploitation warrant prompt remediation.