Kiteworks patches critical flaw, brings customer systems online
Source Bleeping Computer
Rated Critical by Bleeping Computer
Data as of 29 Sep 2026, 09:32 UTC
What to do
AI-suggested
Kiteworks has deployed an official fix for the critical vulnerability and applied additional protective layers across all environments. Customers are advised that the shutdown recommendation has been lifted and systems may be brought back online. Those using self-hosted Kiteworks Advanced Forms should contact Kiteworks support for further assistance. No further immediate action is required for other customers as no exploitation has been detected.
Description
Kiteworks, formerly Accellion, patched a critical vulnerability in a rarely used feature affecting less than 1% of customers. The company had advised customers to temporarily shut down their systems due to a potential imminent cyberattack but later lifted this advisory after applying the patch and finding no evidence of compromise or suspicious activity. The vulnerability has not been assigned a CVE ID, and no exploitation has been observed. Kiteworks provides secure file-sharing services to thousands of global organizations, with a history of targeted attacks on its legacy software by extortion groups. The company recommends affected customers with self-hosted Advanced Forms to contact support for assistance.