CVE-2026-102144

Executive Summary

CVE-2026-102144 is a resource exhaustion vulnerability in the Kiteworks Email Protection Gateway that permits an unauthenticated remote attacker to repeatedly invoke a comparatively expensive server-side operation, degrading service availability. Because the flaw is classified as CWE-306 (Missing Authentication for Critical Function), the impacted operation is reachable without any authentication, lowering the attacker's barrier to entry to simple network access. The CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a partial denial-of-service condition affecting availability only, with no impact to confidentiality or integrity and no scope change.

Technical Analysis

The vulnerability class here is resource exhaustion (a subset of denial-of-service) enabled by a missing authentication control. Per the NVD description, an unauthenticated remote attacker can "repeatedly trigger a comparatively expensive server-side operation," causing a partial denial of service. Two distinct weaknesses combine in this CVE:

1. CWE-306 — Missing Authentication for Critical Function. The expensive operation exposed by the Email Protection Gateway does not require authentication before execution. This is the mechanism that permits an unauthenticated (PR:N) attacker to consume server resources. In typical deployments this maps to a management, health-check, pre-authentication, or message-processing endpoint that performs non-trivial work (for example cryptographic operations, parsing, queueing, or external lookups) before any credential check occurs.

2. Asymmetric resource consumption. The "comparatively expensive" characterization indicates the cost to the server (CPU, memory, thread/connection pool, database or backend calls) is disproportionately larger than the cost to the client to issue the triggering request. This asymmetry is what makes repeated invocation effective at causing degradation.

The CVSS vector confirms the boundary of impact: network reachable (AV:N), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and availability impact limited to Low (A:L) — i.e., partial service degradation rather than a full outage. There is no confidentiality or integrity impact.

Note on specificity: The NVD description and CNA title do not disclose function names, endpoint paths, parameter names, or file paths. No public PoC, Nuclei template, or exploit code is available. Accordingly, the specific server-side operation, its URI, and its parameters cannot be stated without fabrication. The analysis above is therefore bounded to the vulnerability class and attack mechanism as documented. Readers should treat endpoint-level details as unconfirmed.

Affected version information is not available from any tracked source, and the CNA title field is empty. Without vendor confirmation of the fixed release, defenders must assume all currently deployed versions of the Email Protection Gateway may be impacted and verify directly with the vendor.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description and CVSS metrics. No specific code patterns or hypothetical function names are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet-facing Kiteworks Email Protection Gateway. This is the initial and only targeting requirement given the network-reachable, zero-privilege vector (AV:N/PR:N). Identification can be performed by scanning for the gateway's exposed web interface and/or TLS certificate characteristics. No credentials are gathered because none are required.

2. Triggering the flaw class. The attacker locates the unauthenticated server-side operation described in the advisory and invokes it. Because CWE-306 indicates the critical function lacks an authentication gate, the request is processed by the server rather than being rejected at an authorization boundary. No authentication bypass technique, credential, or token is needed.

3. Execution method (class level). The attacker repeats the request — manually or via an automated script — at a rate and volume sufficient to consume the server resources the operation depends on. The "comparatively expensive" nature of the operation means each request imposes disproportionate load relative to the attacker's cost, so repetition produces congestion, latency, or worker/thread exhaustion. This is a volumetric-against-a-costly-resource pattern rather than a classic high-packet-rate flood.

4. Post-exploitation impact. The result is a partial denial of service (CVSS A:L): degraded responsiveness or intermittent unavailability of the Email Protection Gateway and potentially dependent mail flow or email-security processing. There is no documented confidentiality or integrity impact, so this is an availability-degradation event, not a data-breach or code-execution scenario. Sustained repetition could escalate from partial to more severe degradation even though the base vector is scored A:L.

Important caveat: Because no endpoint, parameter, or payload detail is provided by the source data, the exact request format cannot be specified. Defenders should not assume a specific URI; detection should target the pattern (unauthenticated, repetitive, high-cost request behavior) rather than a hardcoded path.

Impact Assessment

CVSS v3.1: 5.3 (Medium) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

• Confidentiality (C:N): No impact — the flaw does not expose data.
• Integrity (I:N): No impact — no data or configuration modification is described.
• Availability (A:L): Low — partial degradation of the gateway's service, consistent with resource exhaustion that degrades rather than fully destroys availability.
• Attack Vector (AV:N) / Complexity (AC:L): Remotely reachable and trivially automatable; no special conditions are described.
• Privileges Required (PR:N): The defining weakness — no authentication is needed, so exposure equals risk.
• Scope (S:U): Impact is confined to the vulnerable component.

Blast radius. The Email Protection Gateway sits in the mail/email-security path. Resource exhaustion there can degrade email inspection, filtering, or delivery for the entire organization, and any downstream systems that depend on the gateway may be affected. Organizations that expose the gateway directly to the internet carry the highest risk. Because the flaw is scored A:L, a single attempt causes limited degradation, but sustained or distributed repetition is the realistic threat and can produce meaningful operational disruption.

Business impact. Primary impact is availability of an email-security control, which can cause delayed email processing and potential compliance or mail-flow disruption. There is currently no evidence of exploitation in the wild, no CISA KEV listing, and no EPSS score (not yet scored by FIRST.org).

Detection Guidance

The source data provides no endpoint path, parameter name, or payload string. The rules below therefore detect the vulnerability class — unauthenticated, repetitive, resource-expensive request behavior against a Kiteworks Email Protection Gateway — and product-identification signals. Where a rule references an endpoint or path, replace the placeholder with the confirmed URI from the vendor advisory once available; until then, threshold/tuning-driven detections are appropriate.

Sigma Rule

title: Potential Kiteworks Email Protection Gateway Resource Exhaustion (CVE-2026-102144)
id: 8f2c5e10-1a44-4b9e-9c3a-kiteworks102144
status: experimental
description: Detects repeated high-frequency requests to the Kiteworks Email Protection Gateway consistent with resource-exhaustion DoS via an unauthenticated expensive operation (CVE-2026-102144, CWE-306).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102144
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_product:
    cs-uri-stem|contains:
      - '/Kiteworks'
      - '/kiteworks'
      - '/epg'
  selection_unauthed:
    sc-status:
      - 200
      - 401
      - 403
      - 500
      - 503
  timeframe: 1m
  condition: selection_product and selection_unauthed | count() by src_ip > 100
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
  - cs(User-Agent)
falsepositives:
  - Legitimate health checks or monitoring probes
  - Load balancer or uptime monitors
level: medium

YARA Rule

rule CVE_2026_102144_Kiteworks_EPG_Recon
{
    meta:
        description = "Detects strings indicating Kiteworks Email Protection Gateway exposure/acceleration tools related to CVE-2026-102144 resource exhaustion. Generic product-identification rule; no exploit payload confirmed."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102144"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $prod1 = "Kiteworks" ascii nocase
        $prod2 = "Email Protection Gateway" ascii nocase
        $prod3 = "kiteworks.com" ascii nocase

    condition:
        any of ($prod*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102144 Possible Kiteworks Email Protection Gateway Resource Exhaustion Attempt"; flow:established,to_server; http.header; content:"Kiteworks"; nocase; http.header; content:"Email Protection Gateway"; nocase; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-102144; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102144; sid:2026102144; rev:1;)

Note: the http.header content matches are product-identification heuristics. Operators should substitute the confirmed request URI/parameter delivered by the vendor once available; the rate threshold implements the "repeatedly trigger" behavior described in the advisory.

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "GET" or http.request.method == "POST" ]
| where
    network.protocol == "http" and
    (
      url.path : "Kiteworks" or
      url.path : "kiteworks" or
      url.path : "epg"
    )

Example standalone EQL count-based rule (KQL-style for use where sequence is unsuitable):

event.category: "web" and
url.path: ("Kiteworks" or "kiteworks" or "epg") and
http.response.status_code: (200 or 401 or 403 or 500 or 503)

Correlate on source.ip with a threshold (e.g., >100 matching events per minute) to approximate the "repeatedly trigger" pattern. Replace url.path values with the vendor-confirmed URI.

Splunk SPL Query

index=web OR index=proxy
| eval target=coalesce(uri_path, url, cs_uri_stem)
| where match(target, "(?i)kiteworks|email.?protection.?gateway|epg")
| stats count AS req_count, dc(target) AS distinct_targets,
        values(status) AS statuses
        by src_ip, target
| where req_count > 100
| sort - req_count
| table src_ip, target, req_count, statuses

This surfaces source IPs issuing a high volume of requests to Kiteworks Email Protection Gateway resources within the search window, matching the repetitive-invocation DoS pattern. Adjust the > 100 threshold to baseline traffic.

Wazuh OSSEC Rule

<group name="web,appsec,kiteworks,">
  <rule id="1021440" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <regex>Kiteworks|kiteworks|Email Protection Gateway|/epg</regex>
    <description>Kiteworks Email Protection Gateway access (CVE-2026-102144 context)</description>
  </rule>

  <rule id="1021441" level="10" frequency="100" timeframe="60">
    <if_matched_sid>1021440</if_matched_sid>
    <same_source_ip />
    <description>Possible resource-exhaustion DoS against Kiteworks Email Protection Gateway (CVE-2026-102144) - excessive repeated requests from same source</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>
</group>

Rule 1021440 is a low-severity classifier; rule 1021441 fires when 100 matching events from the same source IP occur within 60 seconds, implementing the repetition criterion from the advisory. Tune frequency/timeframe to deployment baselines and update the regex with the confirmed endpoint.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version range, or workaround is provided in the available data. Confirm status directly with Kiteworks; do not assume any release is fixed.

1) Immediate mitigations (apply now, given no patch):

• Restrict network exposure. Place the Email Protection Gateway behind a reverse proxy, WAF, or ACL so that only trusted source networks/upstream mail infrastructure can reach the management/pre-authentication surfaces. Because the flaw needs no authentication (PR:N), network restriction is the most effective compensating control.
• Rate limiting and connection caps. Enforce per-source request rate limits and concurrent-connection ceilings at the proxy/WAF for the gateway so that repetition cannot exhaust server resources.
• WAF/virtual patching. Deploy rate-based and anomaly-based virtual patches targeting repeated, high-cost request patterns to the gateway; block or challenge sources exceeding thresholds.
• Monitoring. Enable detection rules above and alert on sustained request spikes from single or few sources.

2) Patch / upgrade steps:

• Contact Kiteworks support and the vendor advisory channel to obtain the fixed release and the definitive affected-version range.
• Once a fix is published, stage and validate it, then upgrade the Email Protection Gateway and any co-deployed Kiteworks components. Because patch confidence is 0/4, treat all current versions as unpatched until vendor confirmation.

3) Long-term hardening:

• Ensure all critical and resource-intensive functions on the gateway require authentication (remediate the underlying CWE-306 condition: no expensive operation should be reachable pre-authentication).
• Adopt resource-consumption accounting and quotas on pre-authentication endpoints.
• Integrate the gateway into a defended perimeter with DDoS/rate-limit protections and continuous availability monitoring.
• Subscribe to vendor security bulletins and re-check this CVE's NVD record for future version/patch updates.

References

• NVD — CVE-2026-102144: https://nvd.nist.gov/vuln/detail/CVE-2026-102144
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST.org EPSS — CVE-2026-102144 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-102144
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102144 not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or threat-actor campaign is referenced in the available data for CVE-2026-102144, and there is no evidence of exploitation in the wild. Affected-version and patch information is unavailable from all tracked sources; verify directly with the vendor.