Affected Systems

Kiteworks Email Protection Gateway (EPG) all versions before 9.4.1. EPG is part of the Kiteworks Private Content Network used by thousands of global corporations and government agencies with over 100 million end-users. Shadowserver tracks nearly 400 exposed instances on the Internet.

Exploitation Status

No evidence of active exploitation reported. Kiteworks issued precautionary shutdown advisory last week based on threat intelligence warning of potentially imminent zero-day attack. Company found no evidence of compromise after investigation. Vulnerability reported via bug bounty program (YesWeHack). Approximately 400 Internet-exposed instances identified by Shadowserver; patch status unknown.

Business Impact

Maximum severity (10.0 CVSS) code injection vulnerability (CVE-2026-54154) enables unauthenticated remote attackers to achieve arbitrary code execution and full root control of EPG appliances. Attack chain combines path traversal, code injection, and missing authentication flaws in publicly reachable endpoints. Low complexity exploitation requires no user interaction. Given widespread enterprise and government use, compromise could enable email interception, data exfiltration, and lateral movement into corporate networks. Kiteworks also patched 11 additional critical vulnerabilities including authentication bypass and admin account takeover flaws.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all Kiteworks Email Protection Gateway instances to version 9.4.1 or later
  • Audit EPG appliance logs from the past 30 days for suspicious authentication attempts, unusual administrative activity, or unexpected code execution on publicly reachable endpoints
  • Verify network segmentation isolates EPG appliances from critical internal systems and implement strict egress filtering
  • If immediate patching is not possible, temporarily isolate EPG instances from the Internet until upgrade can be completed
  • Review Kiteworks advisory for the 11 additional critical vulnerabilities in Core and EPG components and ensure all patches are applied