{"id":"CVE-2026-102106","published":"2026-09-30T21:16:57.490","lastModified":"2026-10-01T14:17:14.417","description":"Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwv8-qhqg-4q76","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":[]}],"exploitRefs":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwv8-qhqg-4q76","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to bypass authentication in the Kiteworks Email Protection Gateway administrative service, enabling them to modify or delete internal users and domains, and change security configurations without proper authorization.","exploitability":"Exploitation is relatively straightforward for an attacker who has access to a valid administrator account, as the password check can be bypassed.","blast_radius":"If exploited, this flaw could lead to unauthorized changes to the gateway's configuration, potentially locking out legitimate administrators and compromising the security of managed domains and users.","remediation":"Upgrade to the latest version of Kiteworks Email Protection Gateway, as version 2.590 or later addresses this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","admin-service","email-protection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:42.886Z"}}