{"id":"CVE-2026-102127","published":"2026-09-30T21:17:01.117","lastModified":"2026-10-01T14:17:17.020","description":"An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.","cvssScore":7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","tags":[]}],"exploitRefs":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84","tags":[]}],"hasPoc":true,"ai":null}