External risk intelligence

Kiteworks Email Protection Gateway Certificate Assignment Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-102149

The affected product is an email protection gateway, which is designed to sit at the network perimeter to intercept and secure incoming/outgoing email traffic. As a public-facing infrastructure component, it is intentionally exposed to the internet to function, making public network reachability a standard and inherent deployment pattern.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Kiteworks Email Protection Gateway could allow an attacker to misuse account certificates, potentially compromising the confidentiality and integrity of encrypted emails and enabling unauthorized account access if certificate-based login is enabled. The main concern is confirming relevance and exposure.

Certificates can be wrongly assigned to accounts.
Affects email security and account access.
Verify product use and assess potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a flaw in Kiteworks Email Protection Gateway, which allows improper restrictions on certificate assignments. By taking advantage of this, an attacker might link a certificate to a different user's account. This could compromise the privacy and honesty of encrypted messages and potentially grant unauthorized entry to an account if certificate-based logins are active.

No special access is needed.
An attacker associates a certificate with another account.
Confidentiality and integrity are at risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to associate a certificate with another user's account on the Kiteworks Email Protection Gateway. This could impact the confidentiality and integrity of that account's encrypted email, and when certificate-based login is enabled, potentially lead to unauthorized access.

Encrypted mail and account access.
Attacker associates certificate with another account.
Compromised confidentiality, integrity, and access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Kiteworks Email Protection Gateway impacts account confidentiality and integrity, with potential for unauthorized access. Identifying all instances of the affected product, confirming their business criticality and network exposure, and then tracing the accountable platform or infrastructure owner is the crucial first step. Remediation planning should follow based on this risk assessment.

Platform or infrastructure owners should manage this.
Verify network exposure and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Kiteworks Email Protection Gateway?

It is a security appliance designed to sit at the network edge, managing and securing the flow of incoming and outgoing electronic mail. Organizations use it to encrypt sensitive communications, enforce security policies, and ensure that email traffic remains protected while in transit.

What does CWE-306 mean for CVE-2026-102149?

CWE-306 refers to a Missing Authentication for Critical Function. In this case, the system fails to properly verify if a certificate is truly associated with the correct user account during assignment. This weakness allows an attacker to bypass intended identity checks, letting them bind a certificate to an account they do not own.

How does an attacker trigger this vulnerability?

An attacker triggers this by exploiting the gateway's failure to enforce strict account-to-certificate mapping. They do not need elevated privileges or special system access to initiate this. Simply interacting with the certificate assignment function is sufficient; normal user activities or legitimate system configuration changes do not trigger this flaw.

Is my Kiteworks gateway at risk?

According to Halo Surface Signal, this software is an internet-facing component by design, making it a high-priority target. Because the gateway must remain reachable from the public network to receive and process external email, any instance exposed to the internet is considered a relevant risk point that warrants immediate attention.

What should I do to address this CVE?

Begin by identifying all Kiteworks instances deployed within your infrastructure and confirm their network exposure. Coordinate with the platform or infrastructure owners to assess the business impact of these systems. Once identified, prioritize these assets for remediation and stay alert for official vendor updates.

References

github.com/kiteworks/security-advisories/security/advisories/GHS…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.