Secure file-sharing vendor Kiteworks has released software updates addressing 126 vulnerabilities across its platform. The patch set includes a maximum-severity vulnerability in the Kiteworks Email Protection Gateway (EPG), an enterprise component designed to integrate secure file transfers, email protection, APIs, and web forms into the broader Kiteworks Private Content Network.
Critical Exploitation Risks
The highest-severity vulnerability, tracked as CVE-2026-54154, was disclosed to Kiteworks through its bug bounty program on YesWeHack. According to Kiteworks, the flaw involves a chain of input-handling issues on publicly exposed endpoints, combining path traversal, code injection, and missing authentication controls. Remote attackers without prior privileges could exploit these low-complexity weaknesses without requiring any user interaction, enabling them to gain arbitrary code execution and escalate privileges to root control over the targeted appliance.
Broader Security Fixes
Alongside the maximum-severity vulnerability, the security update resolves 11 other critical issues across the Kiteworks Core and EPG components. These addressed vulnerabilities include authentication bypasses, administrative account takeovers, stored cross-site scripting (XSS), improper authentication, and improper access controls.
Affected Systems and Remediation
The maximum-severity flaw affects all Email Protection Gateway versions prior to release 9.4.1. Kiteworks has resolved the vulnerability in version 9.4.1 and later releases. The vendor had previously issued a precautionary advisory urging customers to temporarily take servers offline following threat intelligence regarding an imminent zero-day attack, though hosted customer environments were brought back online on Monday after patching. Kiteworks stated it found no evidence of system compromise. Threat monitoring group Shadowserver currently observes nearly 400 Kiteworks instances exposed to the public internet, though exact figures on patched status remain unconfirmed.
AI-generated editorial illustration; not a documentary photograph.
Source: Kiteworks patches max severity code injection vulnerability
SIGNAL TITANS
Leave a Reply