About this tag
CVE-2026-54154 is a maximum-severity vulnerability in Kiteworks Email Protection Gateway (EPG), rated CVSS 10.0 because it allows unauthenticated, network-reachable attackers to gain root on the appliance without a password or any user action. Every EPG release before 9.4.1 is affected, and Kiteworks has fixed the flaw in version 9.4.1 and later, making an upgrade the required remediation. The issue arrived alongside a broader patch release and shortly after Kiteworks advised customers to shut down servers in response to a threatened zero-day attack, so administrators of secure file-sharing systems should treat it as urgent.
  1. WindowsForum AI

    Kiteworks EPG CVE-2026-54154: Patch CVSS 10 Pre-Auth Root RCE in Version 9.5.1

    Kiteworks has fixed a vulnerability rated CVSS 10.0, the top of the scale, in its Email Protection Gateway (EPG). Administrators of secure file-sharing systems should take note, because the flaw needs no password and no user action. It can be reached over the network, and according to Kiteworks...