CVE-2026-102149

Executive Summary

CVE-2026-102149 is a critical authentication and authorization flaw (CWE-306, Missing Authentication for Critical Function) in the Kiteworks Email Protection Gateway, carrying a CVSS 3.1 base score of 9.4. The product insufficiently restricts which account a certificate may be assigned to, enabling an attacker to bind a certificate to another user's account. This compromises the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, may permit full unauthorized account access. All deployments of the Kiteworks Email Protection Gateway are potentially affected; no patch, workaround, or version-specific advisory has been published by any tracked source.

Technical Analysis

The vulnerability resides in the certificate-to-account binding logic of the Kiteworks Email Protection Gateway. Certificate-based systems rely on a trust chain in which a validated client certificate is mapped to exactly one authorized identity. CVE-2026-102149 demonstrates that this mapping is not sufficiently constrained: the gateway fails to enforce that a certificate submitted for assignment belongs to — or is otherwise legitimately controlled by — the account it is being associated with. The result is an improper authorization condition falling under CWE-306, because the critical function of assigning a certificate to an account is effectively performed without adequate verification of the requester's right to perform that assignment.

The attack surface is the certificate assignment/enrollment workflow reachable over the network (CVSS vector AV:N). No privileges (PR:N) and no user interaction (UI:N) are required, and attack complexity is low (AC:L), which is what drives the 9.4 base score. Successful exploitation yields high confidentiality and integrity impact (C:H/I:H) against the victim account, with limited availability impact (A:L). Because scope is unchanged (S:U), the compromise is contained to the Email Protection Gateway trust boundary and the mail accounts it protects, but within that boundary the attacker gains access to encrypted mail and — where certificate-based login is enabled — an authentication path into the victim's account. The underlying root cause is a missing authorization check on the target account identity during certificate association; the gateway accepts a certificate-to-account mapping without confirming that the mapping is authorized by the legitimate account owner.

No public proof-of-concept, exploit code, or Nuclei template exists, and no exploit-in-the-wild activity has been reported. The precise affected version range and the exact interface used for certificate assignment are not disclosed in the available intelligence. The CVSS temporal and environmental scores cannot be calibrated without additional data.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred at the vulnerability-class level (improper certificate-to-account binding / missing authorization), strictly from the NVD description. No specific endpoints, parameters, or function names are asserted, because none are disclosed.

1. Reconnaissance / target identification. The attacker identifies a reachable Kiteworks Email Protection Gateway instance, for example via internet-wide scanning for the product's web interface or certificate-derived hostnames. The attacker identifies a target account (a victim user) whose encrypted mail or certificate-based login is of interest.

2. Triggering the flaw class. The attacker accesses the gateway's certificate assignment functionality and submits a certificate under the attacker's control for association with the victim's account. Because the gateway does not sufficiently restrict which account a certificate may be assigned to, it does not verify that the requester is authorized to bind that certificate to the chosen account. The authorization decision that should block the cross-account mapping is absent.

3. Execution method (class-level). The attacker leverages the missing authorization check to complete the certificate-to-account association without legitimate entitlement to the target account. No credential for the victim account is required; the weakness is in the authorization logic governing the mapping itself, not in the certificate's cryptographic validity alone.

4. Post-exploitation impact. Once the attacker's certificate is associated with the victim's account, the attacker can decrypt, read, and alter the victim's encrypted mail (confidentiality and integrity impact). Where certificate-based login is enabled, the attacker can present the now-bound certificate to authenticate as the victim and obtain unauthorized access to the account. From there, an attacker could persist access, exfiltrate mail content, or use the trusted mail identity for further social-engineering or lateral phishing within the organization.

Impact Assessment

Impact is high and focused on identity and mail confidentiality/integrity. CVSS subscores reflect network reachability (AV:N), no privileges or user interaction (PR:N/UI:N), low complexity (AC:L), and high confidentiality/integrity loss (C:H/I:H) with limited availability loss (A:L) at a 9.4 base score. In business terms, compromise of an Email Protection Gateway account means exposure of encrypted email content, potential tampering with messages, and, when certificate-based login is enabled, a hijacked account that can be used to send authenticated mail as the victim. Since the gateway is an email security control point, an attacker who impersonates a trusted account may bypass controls that downstream recipients rely on. Blast radius is bounded to the gateway's accounts (scope unchanged), but organizations using certificate-based login for privileged or executive mailboxes face elevated risk. Full scope cannot be quantified without affected-version data.

Detection Guidance

Detection is challenging because a legitimate certificate assignment and an abusive one may look similar at the protocol level; the discriminator is who is performing the assignment relative to the account being targeted. The following rules are written at the vulnerability-class level and should be tuned to observed Kiteworks log schemas.

Sigma Rule

title: Suspicious Certificate-to-Account Assignment on Kiteworks Email Protection Gateway
id: 8f1c2a44-5b7e-4d1a-9c33-kiteworks102149
status: experimental
description: Detects certificate assignment events where the acting identity differs from the target account, consistent with CVE-2026-102149.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102149
logsource:
  product: kiteworks
  service: email_protection_gateway
detection:
  selection_event:
    event_type|contains:
      - 'certificate_assigned'
      - 'certificate_binding'
      - 'cert_assigned'
  selection_mismatch:
    actor_account: '*'
  condition: selection_event
  # Correlation: alert when actor_account != target_account on a cert assignment event
falsepositives:
  - Administrative certificate migration or re-provisioning performed by an authorized admin
level: high
tags:
  - attack.t1078
  - cve.2026.102149

YARA Rule

rule CVE_2026_102149_Kiteworks_Cert_Assignment
{
    meta:
        description = "Detects artifacts referencing certificate-to-account assignment on Kiteworks Email Protection Gateway"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102149"
        cve = "CVE-2026-102149"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $p1 = "Email Protection Gateway" ascii wide nocase
        $p2 = "certificate" ascii wide nocase
        $p3 = "assign" ascii wide nocase
        $p4 = "kiteworks" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or
        (any of ($p1, $p4) and any of ($p2, $p3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102149 Kiteworks Email Protection Gateway certificate assignment attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"cert"; nocase; http.uri; content:"assign"; nocase; reference:cve,2026-102149; classtype:attempted-admin; sid:10214901; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [any where event.action == "certificate_assignment_request"]
  [any where event.action == "certificate_assigned" and user.name != destination.user.name]

Splunk SPL Query

index=kiteworks sourcetype="epg:audit"
| search event_type IN ("certificate_assigned","certificate_binding","cert_assigned")
| eval mismatch = if(actor_account != target_account, 1, 0)
| where mismatch = 1
| stats count min(_time) as first_seen max(_time) as last_seen by actor_account, target_account, src_ip
| where count >= 1
| table first_seen, last_seen, actor_account, target_account, src_ip, count

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102149,">
  <rule id="102149" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">certificate_assigned|certificate_binding|cert_assigned</field>
    <field name="actor_account" negate="no">\.+</field>
    <description>CVE-2026-102149: Possible unauthorized certificate assignment on Kiteworks Email Protection Gateway</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence exists from any tracked source, and no vendor fix or version-specific advisory has been published. Treat this as UNPATCHED.

1. Immediate mitigations. Disable certificate-based login for accounts that do not strictly require it, eliminating the unauthorized-access path while retaining mail protection. Restrict network access to the Email Protection Gateway administration and certificate-enrollment interfaces to trusted management networks. Where feasible, require administrative approval or dual control for any certificate-to-account assignment, and audit existing certificate bindings for mappings where the certificate subject does not match the assigned account owner.

2. Patch/upgrade steps. No patch reference is available. Monitor the Kiteworks security advisory channel and the NVD entry for CVE-2026-102149; apply the vendor fix immediately upon release and re-validate all certificate bindings afterward.

3. Long-term hardening. Enforce strong identity binding across the certificate lifecycle, require proof of account control before a certificate can be associated with an account, and integrate certificate assignment into privileged-access governance with continuous monitoring and alerting. Remove standing certificate-based login where SSO or MFA provides equivalent assurance.

References

• NVD — CVE-2026-102149: https://nvd.nist.gov/vuln/detail/CVE-2026-102149
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• FIRST EPSS (score pending; not yet scored as of this report): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed; check for updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, public proof-of-concept, or attributed threat-actor campaign has been observed for CVE-2026-102149 to date.