Kiteworks Patches Critical Email Gateway Flaw Allowing Unauthenticated Root Takeover
Summary
Kiteworks patched 126 vulnerabilities, including CVE-2026-54154, which could let unauthenticated attackers take over Email Protection Gateway appliances. The flaw affects versions before 9.4.1; the company reported no evidence of compromise.
Key points
- CVE-2026-54154 affects Kiteworks Email Protection Gateway releases before 9.4.1 and is patched in version 9.4.1 or later.
- The flaw chains path traversal, code injection, and missing authentication to enable unauthenticated remote code execution and potential root control.
- Kiteworks also fixed 11 critical vulnerabilities in its Core and EPG components, including authentication bypass, account takeover, and access-control issues.
- Kiteworks previously advised customers to shut down servers over a potentially imminent zero-day attack; hosted systems were later restored.
- Kiteworks said it found no evidence of compromise or suspicious activity related to the incident.
- Shadowserver tracks nearly 400 Kiteworks instances exposed to the internet, but does not report how many are patched or may be honeypots.
Article Details
- Vulnerability Types
- Path traversal
- Code injection
- Missing authentication
- Severity
- Critical; maximum severity
- Affected Versions
- Kiteworks Email Protection Gateway releases before 9.4.1
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
Email Protection Gateway (EPG)Kiteworks has issued security updates for 126 vulnerabilities, including CVE-2026-54154, a critical flaw in its Email Protection Gateway that could allow unauthenticated remote code execution and full root takeover.Kiteworks Private Content NetworkEPG is a component of the Kiteworks Private Content Network (PCN), which integrates enterprise email, Managed File Transfer (MFT), file sharing, APIs, and web forms into a single platform.