Kiteworks EPG CVE-2026-54154: Patch CVSS 10 Pre-Auth Root RCE in Version 9.5.1

This bug is the headline item in a much larger patch release. It also comes a few days after Kiteworks told customers to shut their servers down because of a threatened zero-day attack. The two events sit close together on the calendar, but nothing public shows they involve the same flaw, so this article keeps them separate.

What CVE-2026-54154 does​

Kiteworks' GitHub security advisory (GHSA-5xhq-9wq3-rvj6) was published September 30, 2026. It describes a chain of input-handling flaws in EPG endpoints that are reachable from the internet. According to the vendor, an unauthenticated remote attacker could use them to run arbitrary code. By chaining further local weaknesses, the attacker could then reach full administrative (root) control of the appliance.

The advisory lists three weakness categories:

• CWE-22 – Path traversal: the software builds file paths from outside input and doesn't stop that input from escaping the directory it's supposed to stay in.
• CWE-94 – Code injection: outside input ends up inside code the product generates, where it can change what that code does.
• CWE-306 – Missing authentication for a critical function: a sensitive operation runs without checking who is asking for it.

BleepingComputer summarized the result: successful exploitation can let remote threat actors without privileges gain code execution and take over the targeted EPG appliance by exploiting a chain of path traversal, code injection, and missing authentication in low-complexity attacks that don't require user interaction.

The advisory's CVSS v3.1 vector reads AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In plain terms:

These are severity ratings, not reports of attacks. The advisory doesn't say the flaw has been exploited. It also doesn't publish a proof of concept, name the vulnerable endpoints, or list indicators of compromise.

Kiteworks credits researchers wlayzz, icare and truff, who reported the bug through its bug bounty program on YesWeHack. One oddity: the security policy in Kiteworks' advisory repository still points to a public bug bounty on Bugcrowd, which suggests that page hasn't caught up with the program's current home.

Section summary: EPG before 9.4.1 has a pre-authentication flaw chain that can lead to code execution and root. The fix is 9.4.1 or later, and no exploitation has been reported.

Why an email gateway makes this worse​

EPG sits in the mail flow and handles encryption for the whole organization. Kiteworks says EPG automatically enforces data policies on every inbound and outbound email, encrypting, routing, rejecting, or blocking messages based on data and user attributes. It also handles all key management: obtaining, distributing, and maintaining certificates and key pairs.

That's why root on this box matters so much. An attacker who controls the encryption gateway could potentially reach regulated mail traffic and the keys that protect it. According to Kiteworks' own product material, EPG scans inbound messages and automatically routes sensitive data, such as controlled unclassified information (CUI) or protected health information (PHI), to a compliant path. SecurityOnline put the risk plainly: "a breach of one appliance can expose the very data it was bought to protect."

The company's history adds weight. Kiteworks was formerly called Accellion, and Accellion's legacy File Transfer Appliance (FTA) was badly exploited in 2020–2021 in data-theft attacks against many organizations. That history is general industry knowledge, not part of this advisory. Still, it shows that file-transfer and secure-exchange appliances have been prime targets for years, and data-extortion gangs keep coming back to them.

A much bigger patch release, and conflicting counts​

CVE-2026-54154 wasn't released alone. BleepingComputer reports that Kiteworks has released security updates to address 126 vulnerabilities, and that as part of the same set of security patches, Kiteworks has also fixed 11 critical authentication bypass, admin account takeover, stored cross-site scripting (XSS), improper access control, and improper authentication vulnerabilities in the Core and EPG components.

SecurityOnline counts differently. It says Kiteworks disclosed 78 security flaws across its Core platform, Email Protection Gateway, and forms products, and that nine of these rate Critical, led by a 9.8 password reset flaw that can hand over admin accounts. The gap probably comes down to which advisories each outlet counted and when. Kiteworks' repository is paginated and lists many entries published September 30. Treat the totals as approximate. The version boundaries in each advisory are what matter.

The boundaries do differ. CVE-2026-54154 is fixed in EPG 9.4.1. Many of the other advisories posted the same day give 9.5.1 as the fixed version, including:

• An EPG improper access control flaw, rated critical
• A Core administrative account takeover through stored XSS, rated critical
• An EPG arbitrary file write through server-side template injection, rated critical
• A Core remote code execution through server-side template injection, rated high
• An unrestricted file upload flaw in EPG, rated high

SecurityOnline reports that version 9.5.1 fixes them all, and no source reports in-the-wild attacks yet. Its breakdown of the affected products: Kiteworks Core with 16 records fixed in 9.5.0 and 12 more fixed in 9.5.1; Email Protection Gateway with 12 records fixed in 9.5.0 and 7 more fixed in 9.5.1, plus Secure Data Forms fixes.

So 9.4.1 closes CVE-2026-54154, but it isn't enough. If you stop at 9.4.1, the other critical EPG and Core flaws fixed in 9.5.x are still open. Based on the published boundaries, 9.5.1 is the version that covers the whole batch.

Section summary: Reported totals run from 78 to 126 flaws, with 9 to 11 rated critical. To close all of them, plan on 9.5.1, not just the 9.4.1 minimum for CVE-2026-54154.

The emergency shutdown: separate, as far as anyone has said​

The timing is what makes this story unusual. Last week, Kiteworks urged customers to shut down their servers after receiving threat intelligence warning of a potentially imminent zero-day cyberattack.

In a September 28 statement, Kiteworks said it issued the shutdown advice on September 25 after receiving credible threat intelligence from federal intelligence authorities. During the shutdown, it found a previously unknown critical vulnerability, which it said is limited to a capability enabled for less than 1% of its customer base. The company said it built and deployed a fix during that window and added an extra layer of protection across all environments. It said all hosted customer systems are back online, it has no sign that any system was compromised, and all other Kiteworks products were unaffected.

That statement doesn't name the vulnerability, and according to BleepingComputer no CVE had been assigned to it. Nothing public connects the shutdown flaw to CVE-2026-54154. The new CVE came through bug bounty researchers, not through federal threat intelligence, and the vendor hasn't linked the two. Assuming they're the same bug is speculation.

Credit where it's due: telling customers to pull production systems offline over a warning rather than a confirmed breach is an expensive move, and Kiteworks made it. A fair counterpoint is that customers are still waiting for basic details on the flaw that caused all that downtime.

What Kiteworks administrators should do now​

The advisory says only to upgrade. It gives no workaround and no steps for checking a system after patching. The list below combines the vendor's version guidance with standard incident-response practice for appliances exposed to the internet.

1. Inventory every Kiteworks component. Check for EPG, Core and Secure Data Forms, and note which ones accept connections from the internet.
2. Check EPG versions. Anything below 9.4.1 is affected by CVE-2026-54154.
3. Upgrade to 9.5.1 if you can. That version boundary covers the critical EPG and Core issues published alongside CVE-2026-54154. If you can't get there right away, 9.4.1 is the bare minimum for this CVE.
4. Confirm the running version after the upgrade. Don't treat a finished maintenance window as proof the patch took.
5. Limit exposure while you wait. Where the business allows it, restrict access to EPG's public-facing interfaces until the patch is in place. This is general hardening advice, not something the vendor prescribes.
6. Hunt for signs of compromise. The vendor has published no indicators, so check appliance logs for unexpected requests to public endpoints, unfamiliar files, new administrative accounts, and unusual outbound connections.
7. Use vendor channels. Kiteworks says existing customers get full details in release notes, and that public advisory details may be disclosed up to 12 months after a fix ships.

How many systems are actually exposed? BleepingComputer notes that Kiteworks serves thousands of global corporations and government agencies. It also reports that Shadowserver tracks nearly 400 Kiteworks instances exposed to the internet, though that count doesn't say which products they run, how many are patched, or how many are honeypots. Read it as a rough measure of exposure, not a count of vulnerable EPG boxes.

The bottom line​

A pre-authentication bug with a 10.0 score in an email encryption gateway is serious, even with no reported exploitation so far. The patch is out, the version numbers are clear, and once researchers start studying the fixed code, exploits for this kind of flaw tend to follow. Get EPG past 9.4.1 now, plan the full move to 9.5.1, and expect a separate disclosure for the zero-day behind the shutdown once Kiteworks publishes it.