Kiteworks has patched a maximum-severity vulnerability in its Email Protection Gateway that could give an unauthenticated remote attacker full control of the appliance, BleepingComputer reported Thursday. The fix, in version 9.4.1, arrived in a release that addresses 126 vulnerabilities and comes days after the secure file-sharing company asked customers to take servers offline over an unrelated threat.

What Happened

The flaw is tracked as CVE-2026-54154 and affects all Email Protection Gateway (EPG) releases before 9.4.1. Kiteworks' advisory describes it as a combination of input-handling weaknesses, specifically path traversal, code injection and missing authentication, in endpoints that are publicly reachable.

According to the advisory, exploitation is low in complexity, needs no privileges and requires no action from a user. A successful attacker could run arbitrary code and escalate to root, the highest level of control on the system.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The bug was reported through Kiteworks' bug bounty program on the YesWeHack platform. Version 9.4.1 and later contain the fix.

The release is large. BleepingComputer counted 126 vulnerabilities addressed in total, including 11 other critical issues in Kiteworks' core platform and the EPG. Those involve authentication bypass, account takeover, cross-site scripting and access control failures.

Why It Matters

Email security gateways and file-transfer systems handle sensitive data by design and are often exposed to the internet, which has made them prime targets for data-theft gangs. A flaw that needs no login and leads to root access is the kind attackers look for on such devices.

The Shadowserver Foundation tracks nearly 400 Kiteworks instances exposed online, BleepingComputer reported, though it is unclear how many are running the gateway or have been updated. No exploitation of CVE-2026-54154 has been reported.

Customers running the gateway should treat the update as urgent. With 126 fixes in one release, a delay leaves an exposed appliance open to several serious bugs at once, not just the headline flaw.

A Busy Fortnight for Kiteworks

The EPG patch follows a separate episode that drew wide attention. Late last week, Kiteworks urged customers worldwide to shut down their servers over the weekend after federal threat intelligence warned of a possible imminent attack. That advisory concerned a critical, previously unknown flaw in Kiteworks Advanced Forms, a secure data-collection tool used by a small share of customers.

The company said it fixed that bug during the shutdown, restored hosted systems Monday and found no sign that it had been exploited. The Email Protection Gateway flaw is a different issue in a different product.

What to Watch

Watch whether proof-of-concept code or exploitation reports emerge for CVE-2026-54154 now that the advisory is public, since detailed descriptions of path traversal and missing-authentication flaws often speed up attacker research. Shadowserver's exposure counts in the coming days should show how quickly customers move to 9.4.1, and any assignment of a CVE to the Advanced Forms bug would add detail to last week's episode.