high7.0
CVE-2026-102127
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references.
Impact
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Accellion | Kiteworks | before 9.5.1 |