Cybersecurity
Kiteworks patches code injection flaw in Email Protection Gateway
Kiteworks said it had fixed 126 vulnerabilities, including a highest-severity flaw in its Email Protection Gateway that could allow an unauthorised remote attacker to reach root control.
- Kiteworks released updates for 126 vulnerabilities, including one it described as the highest severity in its Email Protection Gateway.
- The flaw was tracked as CVE-2026-54154 and had been reported through Kiteworks’ YesWeHack bug bounty programme.
- Kiteworks said the issue affected EPG releases before 9.4.1 and was fixed in 9.4.1 or later.
- The company said the flaw could let an unauthorised remote attacker execute code and, by chaining other weaknesses, gain root control of the appliance.
- Shadowserver said it was tracking nearly 400 Kiteworks instances exposed on the internet.
Kiteworks said it had issued updates for 126 vulnerabilities in its software, including one it ranked as the highest severity in its Email Protection Gateway. EPG is part of the company’s Private Content Network, which combines email, managed file transfer, file sharing, APIs and web forms.
The flaw was tracked as CVE-2026-54154 and had been reported through Kiteworks’ YesWeHack bug bounty programme. Kiteworks said it affected EPG releases before 9.4.1 and that version 9.4.1 or later addressed it.
In its advisory, the company said the issue could let an unauthorised remote attacker execute code and, after chaining other weaknesses, gain root control of the appliance. It said the attack path involved path traversal, code injection and missing authentication.
Last week, Kiteworks told customers to shut down their servers after receiving threat intelligence about a possible imminent zero-day attack. It lifted that warning on Monday after patching a critical vulnerability, said hosted customer systems were back online, and said it had found no evidence of compromise or suspicious activity.
Shadowserver said it was tracking nearly 400 Kiteworks instances exposed on the internet. It did not say how many had been patched or were honeypots.
Named in this story
Companies
- Kiteworks
- released the security updates and issued the advisory
- YesWeHack
- ran the bug bounty programme that received the report
Organisations
- Shadowserver
- tracked Kiteworks instances exposed on the internet
Products and systems
- Email Protection Gateway
- the security component affected by the flaw
- Kiteworks Private Content Network
- the platform that includes the Email Protection Gateway
How the source tells it
Mostly plain reporting, with a cautious security-advisory register created by severity labels and the company’s warning of a possible imminent attack, then briefly softened by reassurance that it found no compromise.
- urgency severity labels and a warning about a possible imminent zero-day attack
- reassurance the company’s later statement that it found no evidence of compromise and had restored systems