Kiteworks, a secure file-sharing software company, has released patches addressing 126 vulnerabilities in its systems. Among these flaws is a maximum-severity code injection vulnerability affecting the Email Protection Gateway component of the Kiteworks Private Content Network. The vulnerability, tracked as CVE-2026-54154, was discovered through the company’s bug bounty program. Unauthenticated attackers could potentially exploit a combination of input-handling flaws to achieve code execution and gain full administrative control of the affected appliance. The flaw impacts all Email Protection Gateway versions before 9.4.1 and has been patched in later releases.
Additionally, Kiteworks fixed 11 critical vulnerabilities related to authentication bypass, admin account takeover, and cross-site scripting in its Core and Email Protection Gateway components. The company serves thousands of global corporations and government agencies through its Private Content Network, which has over 100 million end-users. Earlier this month, Kiteworks had advised customers to shut down servers due to threat intelligence warning of potential zero-day attacks, but lifted the advisory after deploying patches and finding no evidence of compromise or suspicious activity.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
