CVE-2026-102127: Accellion Kiteworks

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.

Affected products

• Accellion Kiteworks: before 9.5.1 (fixed in 9.5.1)

Published 2026-09-30. Last modified 2026-10-08.