Kiteworks Email Protection Gateway contains a stored cross‑site scripting flaw that permits authenticated administrators to embed malicious scripts via a configuration interface. When end users interact with the affected UI, the injected script executes within the user’s browser. The vulnerability is categorized as CWE‑79 and carries a CVSS score of 8.1, reflecting a high‑severity risk to confidentiality and integrity.

The issue affects all Kiteworks Email Protection Gateway installations running any version earlier than 9.2.0. Administrators with valid credentials can use the configuration interface to inject scripts, while the risk extends to any user who interacts with the compromised UI. Upgrading to version 9.2.0 or later removes the vulnerability.

With a CVSS score of 8.1, the flaw represents significant potential impact, yet its EPSS score of less than 1 % indicates a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been recorded. Based on the description, it is inferred that the attack vector requires an authenticated administrator session accessing the configuration interface, as the vulnerability exploits the application’s failure to sanitize input and a lack of protective content‑security policy.