Kiteworks patches a no-login CVSS 10.0 code-injection flaw in its Email Protection Gateway
Kiteworks fixed CVE-2026-54154, a CVSS 10.0 flaw letting unauthenticated attackers run code on its Email Protection Gateway, in version 9.4.1. Other EPG flaws disclosed the same day are fixed only in 9.5.1, so internet-facing gateways should go straight to that release.
The Engineer · Build desk
What happened
- The CVSS v3.1 vector rates the attack as network-based and low in complexity, with no user interaction required.
- Kiteworks has not published which EPG endpoint is affected or what a malicious request looks like.
- Three weakness classes are assigned, CWE-22, CWE-94 and CWE-306, though the write-up notes they do not settle the order an exploit uses them in.
- The public advisory does not report any exploitation of the flaw in the wild.
Why it matters
- What it limits constraint A WAF in front of EPG has no published endpoint or request pattern to match against, so restricting who can reach the gateway is the stopgap, and only until the patch is applied.
- What it costs cost With no vendor IoCs, showing a gateway was not hit depends on access logs, process-creation audit logs and configuration histories that standard system logs may not capture.
- Who's exposed exposure A compromised gateway could put its configuration, credentials, encryption keys and message processing in reach, though the write-up labels this inference with no confirmed cases.
Next story · Security · 15h ago
Suspected China-nexus actor exploited BeyondTrust Remote Support zero-day from late AugustConfirmed8 publishers
The advisory went out on 2026-09-30 [2]. The dev.to write-up that summarises it lays out a successful attack in three steps [14]:
1. The attacker has a network path to an EPG release older than 9.4.1 [14]. 2. A crafted request reaches the public endpoint and the injected code runs on the appliance [14]. 3. The attacker chains further local weaknesses to get root [5].
Step three is conditional. Kiteworks says root requires additional local weaknesses chained after code execution [5]. Steps one and two need nothing but reachability. According to Kiteworks, the flaw is in input handling on externally reachable EPG endpoints [4]. The bug class is input handling, on an appliance bought to inspect other people's input. The write-up's severity basis notes that EPG deployments may be exposed to the internet and says patching should be prioritized for that reason [13].
The 10.0 assumes a network attacker who can reach the endpoint, at low attack complexity [3]. Before the patch is in, step one is the only part an operator controls. The write-up recommends isolating gateway management and the target endpoints from the internet, with access limited to trusted sources, until the update is applied [10]. That cuts the set of attackers who meet the score's assumption down to the sources on the allow list [3][10].
The write-up's hunting list is specific. The first place to check is the reverse proxy or WAF in front of EPG, for unknown source IPs, anomalous paths, and whether those requests drew errors or successes [18]. On the appliance itself, the signs are shells or utilities launched by web processes, and local administrator accounts being created, modified or logged into [18]. The Kiteworks management console records configuration changes, encryption key or certificate updates, and connector modifications [19]. Network records should be checked for outbound traffic from EPG to unknown destinations [19]. Mail flow gives supporting evidence: sudden gaps in message tracking logs, unusual queue backlogs, changed delivery rules [20].
The two same-day advisories are an EPG access-control issue and a stored XSS in Kiteworks Core, both listed against 9.5.1 [9]. The Core entry means the gateway is not the only Kiteworks component to check. The write-up's instruction is to verify the applied release against each fix, one advisory at a time [8].
What to watch
- Kiteworks or outside researchers publishing the vulnerable endpoint or request details, giving defenders something to filter on and attackers something to build from.
- Any report of in-the-wild exploitation of CVE-2026-54154, or Kiteworks adding indicators of compromise to the advisory.
- Identification of the local weaknesses needed to turn code execution into root, and whether any of them is covered by the 9.5.1 access-control fix.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption35
- Hype gap+5
- Incentives
- Not scored
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Kiteworks Email Protection Gateway before 9.4.1 is vulnerable to Improper Control of Generation of Code ('Code Injection'), tracked as CVE-2026-54154 and rated Critical.
- [2]
The advisory was published on 2026-09-30.
- [3]
The CVSS v3.1 score is 10.0, with a network attack vector, low attack complexity, no privileges required, and no user interaction required.
- [4]
According to Kiteworks, input-handling flaws in externally reachable EPG endpoints could allow unauthenticated remote attackers to execute arbitrary code on versions before 9.4.1; the CVE is fixed in EPG 9.4.1.
- [5]
Escalation to root privileges requires successfully chaining additional local weaknesses after arbitrary code execution.
- [6]
The public advisory does not report exploitation in the wild.
- [7]
CWE-22, CWE-94, and CWE-306 are assigned, but this classification alone does not determine the exact exploitation order of each weakness.
- [8]
Other EPG vulnerabilities published on the same day are fixed in 9.5.1, so 9.4.1 alone should not be assumed to cover all advisories; users should verify the applied release and each fix.
- [9]
Related same-day sources include a Kiteworks EPG access control advisory (9.5.1) and a Kiteworks Core stored XSS advisory (9.5.1).
- [10]
Until updates are applied, gateway management and target endpoints should be isolated from the internet, with access restricted to trusted sources.
- [11]
The vendor's public advisory lists no specific indicators of compromise.
- [12]
Impacts on gateway configuration, credentials, encryption keys, and message processing are conceivable but not confirmed in actual exploitation.
- [13]
Because EPG deployments may be exposed to the internet, patching should be prioritized.
- [14]
Attack sequence: attackers have network reachability to an affected EPG version (before 9.4.1); crafted requests are processed by the public endpoint and code injection succeeds; root is reached by chaining additional local weaknesses.
- [15]
Specific request details and target endpoint details for the attack have not been published.
- [16]
Because target endpoint and attack request details are unpublished, WAFs cannot be guaranteed to block this CVE; access restrictions should be treated as temporary mitigations and vendor patches applied.
- [17]
The write-up infers that access logs, process creation audit logs, and configuration change histories may show anomalous requests, child processes, and unauthorized administrative actions, and that standard system logs may not capture all of these events.
- [18]
Suggested checks: reverse proxies and WAFs in front of EPG for unknown source IPs, anomalous paths, and error or success responses; shells or utility launches from web processes; creation, modification, or login of local administrator accounts on the EPG.
- [19]
Suggested checks: configuration changes in the Kiteworks management console, updates to encryption keys or certificates, connector modifications, and outbound traffic from the EPG to unknown destinations.
- [20]
Sudden gaps in message tracking logs, unusual queue backlogs, and changes to delivery rules can serve as supporting evidence of compromise.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comKiteworks patches max severity code injection vulnerability
2 articles · October 1, 2026
- dev.toKiteworks EPG CVE-2026-54154: Pre-Auth RCE with Potential Root Escalation
1 article · October 1, 2026
Topics and entities
Entities
- Kiteworks Email Protection Gateway
- Shadowserver
- Kiteworks
- Kiteworks Private Content Network