Kiteworks patches max severity code injection vulnerability
Kiteworks patched CVE-2026-54154, an unauthenticated code-injection flaw that can give attackers root on Email Protection Gateway appliances.
Kiteworks patched 126 vulnerabilities, including maximum-severity CVE-2026-54154 in Email Protection Gateway releases before 9.4.1. An unauthenticated attacker can chain path traversal, code injection, and missing authentication to execute code and gain root on the appliance. The update also fixes 11 critical authentication-bypass, admin-takeover, stored XSS, and access-control flaws in Core and EPG. After a precautionary shutdown tied to possible imminent attack intelligence, Kiteworks reported no evidence of compromise; Shadowserver tracks nearly 400 exposed instances.
- CVE-2026-54154 allows unauthenticated remote code execution on Email Protection Gateway before 9.4.1.
- Chaining path traversal, code injection, and missing authentication can yield root control.
- The same update fixes 11 other critical flaws in Core and EPG.
- Kiteworks found no compromise after last week's precautionary shutdown.
- Shadowserver tracks nearly 400 internet-exposed Kiteworks instances.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-54154 | NVD description · AI analysis pending | — | — | — | — | — |
Full article391 words · extracted from bleepingcomputer.com · click to collapse
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution.
EPG is a component of the Kiteworks Private Content Network (PCN), which integrates enterprise email, Managed File Transfer (MFT), file sharing, APIs, and web forms into a single platform.
Formerly known as Accellion, Kiteworks provides services to thousands of global corporations and government agencies, and its Private Content Network has over 100 million end-users.
As part of the same set of security patches, Kiteworks has also fixed 11 critical authentication bypass, admin account takeover, stored cross-site scripting (XSS), improper access control, and improper authentication vulnerabilities in the Core and EPG components.
Tracked as CVE-2026-54154, the maximum-severity vulnerability was reported through Kiteworks' bug bounty program on YesWeHack.
Successful exploitation can let remote threat actors without privileges gain code execution and take over the targeted EPG appliance by exploiting a chain of path traversal, code injection, and missing authentication in low-complexity attacks that don't require user interaction.
The flaw affects all Kiteworks Email Protection Gateway releases before 9.4.1 and is now patched in versions 9.4.1 or later.
"A combination of input-handling flaws in publicly reachable endpoints of the Kiteworks Email Protection Gateway potentially allowed an unauthenticated remote attacker to achieve arbitrary code execution and, by chaining additional local weaknesses, to escalate to full administrative (root) control of the appliance," Kiteworks explained in a Wednesday advisory.
Last week, Kiteworks urged customers to shut down their servers after receiving threat intelligence warning of a potentially imminent zero-day cyberattack.
The company lifted the precautionary advisory on Monday after patching a critical vulnerability and brought all hosted customer systems back online, and said that it found no evidence of compromise or suspicious activity. However, Kiteworks has yet to share additional details on the fixed vulnerability and has not yet assigned a CVE ID for easy tracking.
Threat watchdog Shadowserver currently tracks nearly 400 Kiteworks instances exposed on the Internet, but provides no information on how many have already been patched or are honeypots.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.