CVE-2026-102106

Executive Summary

CVE-2026-102106 is a critical improper authentication vulnerability (CWE-287) in the Kiteworks Email Protection Gateway administrative service. The service failed to consistently enforce administrator authentication, allowing an attacker to bypass the required password check by referencing a valid administrator account. With a CVSS score of 9.1, successful exploitation permits unauthenticated creation, modification, or deletion of internal users and managed domains, including changes to their security-feature configuration — and deletion of a managed domain removes its user accounts, potentially locking administrators out of the gateway entirely.

Technical Analysis

The vulnerability resides in the administrative service of the Kiteworks Email Protection Gateway. The root cause is classified as CWE-287 (Improper Authentication): the administrative service "did not consistently enforce administrator authentication, so the required password check could be bypassed." This indicates a broken or incomplete authentication logic path — under certain request conditions, the service processed administrative actions without verifying the caller's password.

The attack surface is the administrative service interface, which is network-accessible per the CVSS vector (AV:N, PR:N, UI:N). No privileges or user interaction are required, and the attacker is unauthenticated. The critical enabling condition described is that the attacker "referenced a valid administrator account." This suggests the bypass hinges on the service accepting a reference to a known/valid administrator identity while skipping the corresponding credential verification step.

Impact to confidentiality is rated None (C:N), while integrity and availability are both rated High (I:H, A:H). This aligns with the described capabilities: destructive and configuration-altering operations (create/modify/delete users and domains) rather than direct data disclosure.

No public proof-of-concept, exploit code, or Nuclei template exists. No affected version range, patch, or workaround has been published by any tracked source. Code-level specifics (function names, endpoints, parameters) are not available from the NVD description and are therefore not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper authentication / auth bypass) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a reachable Kiteworks Email Protection Gateway administrative service (network-facing, per AV:N). Identification could rely on banner/title fingerprinting or known gateway admin interface signatures. The attacker also needs to know or guess a valid administrator account name, since the bypass requires "referencing a valid administrator account."

2. Triggering the flaw. The attacker sends a crafted request to the administrative service that references a valid administrator account but does not supply valid credentials. Because the service fails to consistently enforce the password check, the request is processed as an authenticated administrative action.

3. Execution method. At the vulnerability-class level, this is an authentication-bypass: the payload is a request that supplies, references, or invokes administrative functionality under a valid admin identity without passing verification. The specific parameters or request structure are not documented in the available data.

4. Post-exploitation impact. Once bypass is achieved, the attacker can create, modify, or delete internal users and managed domains, and alter their security-feature configuration. Deleting a managed domain also removes its user accounts and can lock administrators out of the gateway — a destructive, availability-affecting outcome consistent with the High Integrity and High Availability subscores.

Impact Assessment

Business impact is severe. The vulnerability allows unauthenticated attackers to manipulate the gateway's user and domain directory and its security-feature configuration — core trust functions of an email protection gateway that may sit in front of an organization's mail flow. Because deletion of a managed domain removes associated user accounts and can lock out administrators, an attacker can cause operational disruption and deny administrative control (A:H).

CVSS subscores: AV:N (remotely exploitable), AC:L (no special conditions), PR:N (no privileges required), UI:N (no user interaction), S:U (scope unchanged), C:N (no direct confidentiality impact), I:H (full integrity impact), A:H (high availability impact). The 9.1 base score reflects a critical, remotely exploitable integrity/availability threat requiring no authentication. Blast radius includes all users and managed domains administered by the affected gateway instance. There is no CISA KEV listing, no EPSS score, and no known in-the-wild exploitation at this time.

Detection Guidance

Sigma Rule

title: Kiteworks Email Protection Gateway Admin Auth Bypass (CVE-2026-102106)
id: 8f1c2a54-3b7e-4d9a-9c21-6b0f1e2d7a10
status: experimental
description: Detects administrative actions (user/domain create, modify, delete) reaching the gateway without a successful authentication event.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102106
author: valtersit.com
date: 2026-01-01
logsource:
  product: kiteworks
  service: email_protection_gateway
detection:
  selection_admin_actions:
    event_type:
      - 'admin.user.create'
      - 'admin.user.modify'
      - 'admin.user.delete'
      - 'admin.domain.create'
      - 'admin.domain.modify'
      - 'admin.domain.delete'
      - 'admin.security_feature.update'
  filter_authenticated:
    auth_result: 'success'
  condition: selection_admin_actions and not filter_authenticated
falsepositives:
  - Legitimate admin actions where authentication logging is missing or delayed
level: critical

YARA Rule

rule CVE_2026_102106_Kiteworks_EPG_AuthBypass
{
    meta:
        description = "Heuristic detection of references to Kiteworks EPG admin auth bypass indicators in logs or capture artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102106"
        cve = "CVE-2026-102106"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $a = "Email Protection Gateway" ascii nocase
        $b = "admin" ascii nocase
        $c = "managed domain" ascii nocase
        $d = "security-feature" ascii nocase
        $e = "internal user" ascii nocase
    condition:
        uint16(0) == 0x504B or
        (2 of ($a,$b,$c,$d,$e))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102106 Kiteworks Email Protection Gateway admin auth bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin"; nocase; http.header; content:"Cookie|3a|"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-102106; sid:2026102106; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where network.protocol == "http" and url.path : "*admin*" and http.request.method == "POST"]
  [file where event.action in ("creation", "deletion", "change") and file.path : "*kiteworks*"]

Splunk SPL Query

index=kiteworks sourcetype=epg:admin
(admin_action IN ("user.create","user.modify","user.delete","domain.create","domain.modify","domain.delete","security_feature.update"))
NOT auth_result=success
| stats count values(admin_action) as actions by src_ip, user_agent, dest
| where count > 0

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102106,">
  <rule id="102106" level="14">
    <decoded_as>json</decoded_as>
    <field name="event_type">^admin\.(user|domain|security_feature)\.(create|modify|delete|update)$</field>
    <field name="auth_result">^(?!success).*$</field>
    <description>CVE-2026-102106: Kiteworks EPG administrative action without successful authentication.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict network access to the Email Protection Gateway administrative service to trusted management networks only (do not expose the admin interface to untrusted networks).
   • Enforce administrator authentication at a compensating control layer (reverse proxy / access gateway) that independently requires authentication before requests reach the gateway admin service.
   • Enable and monitor administrative action logging, alerting on any admin action lacking a corresponding successful authentication event.
   • Review managed domains and internal user accounts for unauthorized creation, modification, or deletion.

2. Patch/upgrade steps.

   • No vendor patch is currently available per tracked sources. Monitor Kiteworks security advisories and the NVD entry for CVE-2026-102106 for an official fix.
   • When a fixed version is published, upgrade immediately and validate that the authentication enforcement path is corrected.

3. Long-term hardening.

   • Apply the principle of least privilege to administrative interfaces and enforce mandatory authentication on every administrative request path.
   • Network-segment management interfaces away from mail-flow and general user networks.
   • Maintain tested backups of gateway user/domain configuration to recover from destructive deletion of managed domains.
   • Continuously monitor for new patch, PoC, or KEV status updates for this CVE.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102106
• CWE-287 (Improper Authentication): https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-102106 not listed as of this writing)
• Vendor advisory: Kiteworks security advisories — no advisory available in provided data

No threat actor campaigns or exploit-in-the-wild evidence are known for CVE-2026-102106 at this time. No public PoC, exploit code, or Nuclei template has been observed.