CVE-2026-102127
HIGH
NVD
CVSS Score
7
Severity
HIGH
Published
Sep 30, 2026
Vendor
unknown
Description
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.