Kiteworks patches a no-login CVSS 10.0 code-injection flaw in its Email Protection Gateway

The advisory went out on 2026-09-30 ^[2]. The dev.to write-up that summarises it lays out a successful attack in three steps ^[14]:

1. The attacker has a network path to an EPG release older than 9.4.1 ^[14]. 2. A crafted request reaches the public endpoint and the injected code runs on the appliance ^[14]. 3. The attacker chains further local weaknesses to get root ^[5].

Step three is conditional. Kiteworks says root requires additional local weaknesses chained after code execution ^[5]. Steps one and two need nothing but reachability. According to Kiteworks, the flaw is in input handling on externally reachable EPG endpoints ^[4]. The bug class is input handling, on an appliance bought to inspect other people's input. The write-up's severity basis notes that EPG deployments may be exposed to the internet and says patching should be prioritized for that reason ^[13].

The 10.0 assumes a network attacker who can reach the endpoint, at low attack complexity ^[3]. Before the patch is in, step one is the only part an operator controls. The write-up recommends isolating gateway management and the target endpoints from the internet, with access limited to trusted sources, until the update is applied ^[10]. That cuts the set of attackers who meet the score's assumption down to the sources on the allow list ^[3][10].

The write-up's hunting list is specific. The first place to check is the reverse proxy or WAF in front of EPG, for unknown source IPs, anomalous paths, and whether those requests drew errors or successes ^[18]. On the appliance itself, the signs are shells or utilities launched by web processes, and local administrator accounts being created, modified or logged into ^[18]. The Kiteworks management console records configuration changes, encryption key or certificate updates, and connector modifications ^[19]. Network records should be checked for outbound traffic from EPG to unknown destinations ^[19]. Mail flow gives supporting evidence: sudden gaps in message tracking logs, unusual queue backlogs, changed delivery rules ^[20].

The two same-day advisories are an EPG access-control issue and a stored XSS in Kiteworks Core, both listed against 9.5.1 ^[9]. The Core entry means the gateway is not the only Kiteworks component to check. The write-up's instruction is to verify the applied release against each fix, one advisory at a time ^[8].