CVE-2026-102144

Kiteworks Email Protection Gateway Uncontrolled Resource Consumption

View on CVE.org
Published Sep 30, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.

Analysis

AI-generated

Technical impact

A resource exhaustion flaw in Kiteworks Email Protection Gateway enables an unauthenticated attacker to repeatedly initiate an expensive server‑side process, draining server resources and leading to a partial denial of service. The weakness lies in lacking proper input validation and missing rate‑limiting controls, which allow the attack to succeed without authentication.

Affected Systems

The vulnerability affects Kiteworks Email Protection Gateway. Specific affected versions are not disclosed in the advisory.

Risk and Exploitability

The exploit runs over the network; no credentials are required. The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS is unavailable and it is not catalogued in CISA’s KEV list, indicating limited publicly known exploitation. Nevertheless, because it can degrade service availability, operators should treat it as a significant risk worth addressing promptly.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest vendor patch for Kiteworks Email Protection Gateway when it becomes available.
  • If patching is delayed, isolate the gateway behind stricter network controls or implement a rate limiter to cap the number of allowed requests per client per unit time.
  • Monitor system metrics and logs for abnormal spikes in CPU or memory usage associated with the server‑side operation, and adjust resource limits or scaling as necessary.

Generated by OpenCVE AI on September 30, 2026 at 23:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Accellion
Accellion kiteworks
CPEs cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*
Vendors & Products Accellion
Accellion kiteworks
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Kiteworks
Kiteworks kiteworks Email Protection Gateway
Vendors & Products Kiteworks
Kiteworks kiteworks Email Protection Gateway
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}
Type Values Removed Values Added
Description A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.
Title Kiteworks Email Protection Gateway Uncontrolled Resource Consumption
Weaknesses CWE-306
CWE-400
References
Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-400

    Uncontrolled Resource Consumption

Sources

Status
PUBLISHED
Assigner
cisa-cg
Published
Updated
Oct 1, 2026, 3:28 PM
Reserved
Sep 28, 2026, 5:39 PM

View source JSON

Updated
Oct 1, 2026, 3:27 PM

JSON

Status
Analyzed
Published
Sep 30, 2026, 9:17 PM
Modified
Oct 7, 2026, 3:02 PM

View source JSON

No data.

Updated
Oct 1, 2026, 3:30 PM

JSON