CVE-2026-102135

Executive Summary

CVE-2026-102135 is a deserialization-of-untrusted-data vulnerability (CWE-502) in the Kiteworks Email Protection Gateway when configured as a cluster with database replication enabled. A party already trusted by the cluster can submit a crafted serialized object that is deserialized without sufficient validation, potentially achieving code execution as the gateway service account. The flaw carries a CVSS v3.1 base score of 6.6 (Medium) and requires high attack complexity plus high privileges — specifically control of a trusted cluster peer or administrative access to the appliance — with database replication disabled by default.

Technical Analysis

The vulnerability resides in the Email Protection Gateway's handling of serialized objects within a database-replicated cluster topology. Per the NVD description, the gateway deserializes an object supplied by a peer it considers trusted, and that deserialization is performed "without sufficient validation." The root cause class is CWE-502 (Deserialization of Untrusted Data): when a serialization format capable of encoding arbitrary object state — including type information that drives object instantiation and lifecycle callbacks — is fed to a deserializer that does not enforce a strict allowlist of expected types, an attacker who can influence the serialized byte stream can steer the runtime into instantiating attacker-chosen types. Those types may execute logic during construction, finalization, or property population, producing arbitrary code execution in the context of the deserializing process.

The attack surface is the inter-node trust path used to synchronize state between Email Protection Gateway cluster members via database replication. The description is explicit that this path treats the submitting party as trusted, which is why the issue is reached only by a peer the cluster already accepts. The service context in which deserialization occurs is the gateway service account, so any code execution inherits that account's privileges rather than requiring a further local privilege escalation.

Preconditions are clearly bounded in the advisory. First, replication must be enabled; it is disabled by default, so a default installation is not exposed. Second, the attacker must either control a trusted cluster peer or hold administrative access to the appliance. These two conditions are what drive the vector: AV:N because the object can be delivered over the network, AC:H because the attacker must first satisfy the cluster-trust precondition and deliver a serialized payload that survives the parsing path, and PR:H because a peer or admin foothold is required. There is no UI interaction (UI:N), and scope is unchanged (S:U) — the compromise stays within the gateway's security authority. Confidentiality, Integrity, and Availability impacts are each rated High (C:H/I:H/A:H), consistent with arbitrary code execution as a service account that can likely read email content, alter gateway behavior, and disrupt mail processing.

No public proof-of-concept, exploit code, or Nuclei template is known, and the advisory does not publish the specific deserializer, serialization library, affected versions, or exact code path. The analysis above therefore stays at the vulnerability-class and mechanism level; details such as which serializer is used, whether the payload is a raw replication record or a message body, and which types form a viable gadget chain are not established by the available data and should not be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the explicit preconditions stated in the NVD description. It uses no specific function, endpoint, or parameter names beyond what the description provides.

1. Reconnaissance / target identification. An attacker identifies a Kiteworks Email Protection Gateway deployment that is operating as a cluster with database replication enabled. Because replication is off by default, this narrows the target set to organizations that have deliberately built out a replicated gateway cluster — typically larger enterprises with high-availability mail-security requirements. Discovery can proceed at the network/administrative level (identifying gateway management interfaces and the cluster/replication channel) rather than through a remotely fuzzable public endpoint, since the flaw sits behind a trust boundary.

2. Trust establishment (the hard precondition). The attacker must become a party the cluster already trusts. Per the advisory, this means either controlling a trusted cluster peer or gaining administrative access to the appliance. This can be achieved through compromise of a peer node, abuse of cluster-enrollment or admin credentials, or any prior foothold that grants cluster-member or administrative standing. This step is what makes AC:H/PR:H appropriate — it is the dominant cost of the attack.

3. Payload delivery at the vulnerability-class level. Acting as a trusted peer, the attacker submits a crafted serialized object over the inter-node replication path. The gateway deserializes it without sufficient validation. In CWE-502 terms, the payload encodes object state that causes the deserializer to instantiate types whose construction/finalization logic executes attacker-influenced behavior. No specific serializer, class, or gadget chain is disclosed by the advisory, so the precise encoding is not described here.

4. Post-exploitation impact. Successful deserialization yields code execution as the gateway service account. Given that account's role in mail protection, realistic consequences include reading or exfiltrating email content, tampering with gateway processing (e.g., suppressing detection or altering message handling), persisting within the cluster, and using the trusted peer relationship to move laterally to additional cluster members, all within the unchanged scope of the gateway's security authority.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H yields a base score of 6.6 (Medium). The score profile reflects a vulnerability that is serious in consequence but gated by demanding preconditions:

• Confidentiality: High. Code execution as the gateway service account can expose email content, configuration, and potentially credentials/secrets handled by the gateway.
• Integrity: High. An attacker with code execution in the gateway service context can modify message handling, detection logic, or cluster data.
• Availability: High. The same access can disrupt or disable mail processing and cluster replication.
• Attack Vector: Network. The serialized object is delivered over the network to a replication/peer path.
• Attack Complexity: High. Exploitation requires the cluster-trust precondition and a viable serialized payload; success is not trivial or probabilistic in a single request.
• Privileges Required: High. The attacker must control a trusted cluster peer or have administrative appliance access.
• User Interaction: None. No victim user action is required.
• Scope: Unchanged. Impact is confined to the gateway's security authority.

Blast radius. Exposure is limited to Email Protection Gateway deployments that (a) run as a cluster and (b) have database replication enabled. Standalone or default configurations are not exposed. Where the preconditions hold, a single compromised peer or admin foothold can translate into code execution on gateway nodes and, via the same trust relationships, into broader cluster compromise. Business impact centers on mail confidentiality and integrity, potential regulatory exposure from unauthorized access to email content, and operational disruption of mail security controls.

Detection Guidance

Sigma Rule

title: Kiteworks Email Protection Gateway Deserialization - Cluster Peer Abuse (CVE-2026-102135)
id: 3f9a1c2e-7b64-4d21-9c0a-1e5b8d2f4a77
status: experimental
description: Detects anomalous process creation or mail-security service child processes on Kiteworks Email Protection Gateway nodes consistent with code execution via deserialization of a crafted object from a trusted cluster peer (CWE-502).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102135
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
  - cwe.502
logsource:
  category: process_creation
  product: linux
detection:
  selection_gateway:
    ParentImage|endswith:
      - '/kiteworks'
      - '/gateway'
      - '/java'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
  selection_replication:
    CommandLine|contains:
      - 'replicat'
      - 'cluster'
  condition: selection_gateway and selection_replication
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate administrative maintenance scripts executed by the gateway service account
level: high

YARA Rule

rule CVE_2026_102135_Serialized_Object_Replication_Payload
{
    meta:
        author = "Threat Intelligence"
        description = "Detects Java-style serialized object markers and common deserialization gadget signatures in data crossing Kiteworks EPG replication/peer paths (CWE-502)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102135"
        date = "2026-01-01"
        cve = "CVE-2026-102135"

    strings:
        $magic = { AC ED 00 05 }
        $gadget1 = "java.lang.Runtime" ascii
        $gadget2 = "java.lang.ProcessBuilder" ascii
        $gadget3 = "java.io.ObjectInputStream" ascii
        $gadget4 = "TemplatesImpl" ascii
        $gadget5 = "InvokerTransformer" ascii
        $epg1 = "replication" ascii nocase
        $epg2 = "cluster" ascii nocase

    condition:
        $magic and (
            any of ($gadget*) or
            (all of ($epg*))
        )
}

Suricata IDS Rule

alert tcp any any -> any 5432 (msg:"CVE-2026-102135 Kiteworks EPG potential Java deserialization payload in cluster replication traffic"; flow:established,to_server; content:"|AC ED 00 05|"; offset:0; depth:4; content:"java.lang.Runtime"; within:8192; classtype:attempted-admin; reference:cve,2026-102135; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102135; metadata:created_at 2026_01_01, cve CVE_2026_102135; sid:2026102135; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("java", "kiteworks", "gateway") and
  process.name in ("sh", "bash", "python", "python3", "perl", "curl", "wget", "nc") and
  process.args : ("*replicat*", "*cluster*")

Splunk SPL Query

index=* (sourcetype=linux_secure OR sourcetype=syslog OR sourcetype=osquery)
| search ("deserial" OR "ObjectInputStream" OR "replication" OR "cluster")
| stats count min(_time) as firstTime max(_time) as lastTime by host, process_name, message
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102135,">
  <rule id="100235" level="12">
    <decoded_as>json</decoded_as>
    <field name="parent_process">java</field>
    <field name="process">sh|bash|python|curl|wget</field>
    <field name="command_line">replicat|cluster</field>
    <description>CVE-2026-102135: Suspicious child process from Kiteworks Email Protection Gateway service account, possibly deserialization-based code execution via cluster peer.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102135,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No CVE maps this vulnerability to a fixed version, and no vendor advisory or workaround is currently available.

1. Immediate mitigations.

   • Disable database replication on Email Protection Gateway clusters where high-availability replication is not operationally required. Replication is disabled by default, so reverting non-essential clusters to the default configuration removes the attack path entirely.
   • Where replication must remain enabled, strictly control and audit cluster membership. Reduce the number of trusted peers and rotate/limit administrative credentials to the appliance.
   • Segment the cluster/replication network so that only authorized cluster nodes can reach the replication listener (host firewall or network ACL); this blocks a non-peer from delivering a serialized object even if trust were somehow bypassed.
   • Monitor closely for compromise of any trusted peer or administrative account, since either is a direct precursor to exploitation.
   • Apply compensating controls at the mail-security layer (logging/alerting on gateway behavior changes) so tampering is at least detectable given code execution can suppress downstream controls.

2. Patch / upgrade steps.

   • No patch or fixed version is presently documented. Monitor the Kiteworks security advisory channel and the NVD entry for CVE-2026-102135.
   • When a vendor fix is released, prioritize upgrading Email Protection Gateway nodes with replication enabled first, then validate cluster health.
   • Because no fixed version exists, confirm current build numbers against any vendor guidance and treat unpatched replicated clusters as highest priority.

3. Long-term hardening.

   • Require strict allowlisting/type validation on any object deserialization that crosses a trust boundary, and treat inter-node data as untrusted even when it originates from a peer.
   • Enforce least privilege for the gateway service account so code execution cannot trivially escalate to host or cluster-wide control.
   • Deploy robust logging on the gateway with alerting on unexpected child processes or replication anomalies.
   • Maintain a vulnerability-management process that tracks default-off features which raise risk when enabled, and re-evaluate the security posture each time such a feature is turned on.

References

• NVD — CVE-2026-102135: https://nvd.nist.gov/vuln/detail/CVE-2026-102135
• CWE-502, Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• Kiteworks Security Advisories (vendor advisory channel; no specific advisory published for this CVE at time of writing): https://www.kiteworks.com/security
• FIRST EPSS (score not yet assigned for CVE-2026-102135): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102135 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No CISA KEV listing, no public proof-of-concept, no exploit code, and no known in-the-wild exploitation or threat-actor campaign are associated with CVE-2026-102135 based on the data provided.