A Vulnerability in Kiteworks EPG (Email Security Gateway) Could Allow for Arbitrary Code Execution

A vulnerability has been discovered in Kiteworks EPG (Email Security Gateway) that could allow for arbitrary code execution. Kiteworks Email Protection Gateway (EPG) is a cloud-based security solution that automates end-to-end encryption, decryption, and policy enforcement for inbound and outbound enterprise emails. A combination of input-handling flaws in publicly reachable endpoints of the Kiteworks Email Protection Gateway may potentially allow an unauthenticated remote attacker to achieve arbitrary code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution as root, which may lead to the complete compromise of the affected device.

There are currently no reports of this vulnerability being exploited in the wild.

A vulnerability has been discovered in Kiteworks EPG (Email Security Gateway) that could allow for arbitrary code execution. Details of the vulnerability are as follows:

Tactic:Initial Access(TA0001)

Technique:Exploit Public-Facing Application(T1190)

Successful exploitation of this vulnerability could allow for arbitrary code execution as root, which may lead to the complete compromise of the affected device.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®