---
cve: "CVE-2026-102097"
severity: "HIGH"
cvss: 7.2
epss: "1%"
vendor: "Kiteworks"
kev: false
exploited: false
published: "2026-09-30 21:16:56"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T14:25:28+02:00"
---

# CVE-2026-102097

> 7.2 HIGH · 🧪 PoC

## Beschreibung

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.

## CNA-Record (Kanon, cvelistV5)

- CNA: **cisa-cg**
- State: PUBLISHED
- Stand: 2026-10-01 13:37:08
- CNA-CVSS: **7.2** (`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-22** — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- **CWE-94** — Improper Control of Generation of Code ('Code Injection')
  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

## Angriffsmuster (CAPEC)

- [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_
- [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_
- [CAPEC-126 — Path Traversal](https://capec.mitre.org/data/definitions/126.html) _(Severity: Very High)_

## BSI-Hinweise (deutsch)

- [Kiteworks: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3695) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Kiteworks ausnutzen, Authentifizierungs- oder Zugriffskontrollen zu umgehen, Benutzer- oder Administratorkonten zu übernehmen, Berechtigungen zu erhöhen, sensible Informationen auszulesen oder zu verändern, beliebige Dateien zu schreiben, interne Systeme per SSRF anzusprechen, SQL- oder Betriebssystembefehle einzuschleusen, Remote Code Execution zu erreichen oder Dienste durch Denial-of-Service zu beeinträchtigen.

## Referenzen

- <https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr>
- <https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-102097/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_