high7.2
CVE-2026-102108
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deseri…
Impact
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Accellion | Kiteworks | before 9.5.0 |