Reported by 15 outlets
Kiteworks critical vulnerability and precautionary shutdown advisory
Why this score
- Breadth
- 2.00 / 2.0 · 15 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
Kiteworks, the San Mateo secure file-sharing vendor formerly known as Accellion, told customers on Friday September 25 to shut down production servers after receiving what CISO Frank Balonis called credible threat intelligence from federal law enforcement that an attack was imminent. The coordinated outage window ran Saturday September 26, reported as six hours in the customer email Heise obtained and nine hours in later coverage, staggered across time zones. Customers were told to power down even when their systems were not internet-facing, and Kiteworks took down the hosted environments it runs on customers' behalf. Shadowserver counted roughly 400 internet-accessible Kiteworks instances at the time, 234 of them in the United States.
During the shutdown the company found a previously unknown critical vulnerability in Advanced Forms, a secure data collection feature used by fewer than 1 percent of customers, about 50 organizations. Kiteworks says the flaw is confined to that feature, that file collaboration, file transfer, email encryption and managed file transfer are unaffected, and that it developed and deployed a fix inside the window with no indication of exploitation. No CVE identifier has been assigned. Release 9.5.1 addresses all vulnerabilities known to the company. Continuous monitoring showed no abnormal activity, the advisory was lifted, and hosted systems came back online by Monday September 28. Self-hosted Advanced Forms customers were told to contact support.
The episode stands out for its scale and its opacity. A vendor ordering a global customer base to unplug production systems on an imminent-attack warning has precedent in the Accellion FTA era, and Kiteworks serves much of that same customer base. German authorities stayed quiet, with the BKA declining comment and BSI not responding, and the company has said only that it worked with industry partners including Mandiant. Watch for disclosure of the Advanced Forms vulnerability details and a CVE, identification of the threatened attacker, and any customer report that contradicts the no-compromise conclusion.
Timeline
-
original reporting
🤖 Kiteworks (ex-Accellion) lifted its precautionary shutdown advisory after patching a critical flaw in Advanced Forms. Customers were told
www.bleepingcomputer.com · 14d ago · September 29th, 2026
🤖 Kiteworks (ex-Accellion) lifted its precautionary shutdown advisory after patching a critical flaw in Advanced Forms. Customers were told
via Mastodon https://www.bleepingcomputer.com/news/security/kiteworks-lifts-shutdown-warning-after-patching-critical-flaw/
-
original reporting
Kiteworks patched an undisclosed critical vulnerability after federal intelligence warned of an imminent attack that prompted a global serve
cyberworldops.eu · 14d ago · September 29th, 2026
Kiteworks patched an undisclosed critical vulnerability after federal intelligence warned of an imminent attack that prompted a global serve
via Mastodon https://cyberworldops.eu/en/kiteworks-reopens-customer-systems-after-emergency-fix-for-critical
-
update from heise.de
Server am Samstagmorgen herunterfahren: Kiteworks warnt Admins vor Zero-Day (heise security, German original)
heise.de · 18d ago · September 25th, 2026
heise security published the German-language original of the Kiteworks shutdown story on 25.09.2026 at 13:41 CEST, about ten minutes before its English translation and minutes before this story's first sighting. It quotes CISO Frank Balonis's customer email citing credible threat intelligence from law enforcement and the six-hour worldwide shutdown window on Saturday, September 26, 04:00 to 10:00 in Central Europe. A 17:41 CEST update adds that Germany's BKA declined to comment citing investigative tactical reasons, while BSI had not responded by late Friday afternoon.
-
update from heise.de
Imminent Zero-Day Attack: KiteWorks Urges Customers to Shut Down Servers
heise.de · 18d ago · September 25th, 2026
The company recommended shutting down systems worldwide for six hours starting Saturday, September 26 at 4:00 a.m. Central European time, even if systems are not directly internet-accessible. Kiteworks customer support told Heise the reason was to protect against potential zero-day attacks. The article notes large German companies including state banks, insurance firms, media groups, consulting firms, and automotive suppliers use Kiteworks products.
-
update from www.heise.de
Imminent Zero-Day Attack: KiteWorks Urges Customers to Shut Down Servers
www.heise.de · 18d ago · September 25th, 2026
The manufacturer writes to its customers that it has concrete indications
via Mastodon https://www.heise.de/en/news/Imminent-Zero-Day-Attack-KiteWorks-Urges-Customers-to-Shut-Down-Servers-11466375.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon
-
update from techcrunch.com
Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack
techcrunch.com · 18d ago · September 25th, 2026
The company recommended shutting systems before the weekend as a precaution, stressing no confirmed compromise. The article notes Kiteworks has thousands of customers across healthcare, technology, education, automotive, and government, and references at least a thousand internet-facing Kiteworks instances spotted by security researcher Kevin Beaumont. Kiteworks CISO Frank Balonis confirmed the advisory and said all known vulnerabilities are addressed in release 9.5.1.
-
update from bleepingcomputer.com
Kiteworks urges 6-hour server shutdown over potential zero-day attacks
bleepingcomputer.com · 18d ago · September 25th, 2026
The shutdown recommendation was intended to protect against potential zero-day attacks, though neither the company statement nor customer notification confirmed a zero-day had been discovered or exploited. The article notes Kiteworks says all known vulnerabilities are fixed in version 9.5.1 and references the Clop extortion gang's history of targeting file-transfer platforms, including Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, and MOVEit Transfer.
-
update from bleepingcomputer.com
Kiteworks urges 6-hour server shutdown over potential zero-day attacks
bleepingcomputer.com · 18d ago · September 25th, 2026
Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. According to German technology publication Heise , Kiteworks CISO Frank Balonis emailed customers warning that the company had received "credible threat intelligence from law enforcement indicating an attack on Kiteworks systems may be imminent this weekend." "We strongly recommend you shut down your Kiteworks system for six hours," the notification reportedly states. Heise says the shutdown window applies to customers worldwide, with affected time zones ranging from Australian Eastern Standard Time (AEST) to Pacific Daylight Time (PDT). In New York, the shutdown window would be from 10:00 p.m.
-
mentioned by www.bleepingcomputer.com
Kiteworks urges 6-hour server shutdown over potential zero-day attacks https:// bleepingcomputer.com/news/security/ kiteworks-urges-6-hour-s
www.bleepingcomputer.com · 18d ago · September 25th, 2026
-
update from cyberworldops.eu
Kiteworks has instructed customers to take servers offline for six hours on Sept 26 following credible law enforcement intelligence of an im
cyberworldops.eu · 18d ago · September 25th, 2026
Kiteworks has instructed customers to take servers offline for six hours on Sept 26 following credible law enforcement intelligence of an im
via Mastodon https://cyberworldops.eu/en/kiteworks-calls-for-six-hour-server-blackout-after-warning-of-a
-
mentioned by www.heise.de
"The American software company KiteWorks has warned its customers of an imminent cyberattack. In an email obtained by heise security, the Ki
www.heise.de · 18d ago · September 25th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 Kiteworks told customers worldwide to shut down servers for a 6h window on Sat, Sept 26, after law enforcement warned of a potentially imm
www.bleepingcomputer.com · 18d ago · September 26th, 2026
-
update from cyberpress.org
Kiteworks Customers Told to Shut Down Servers Over Possible Zero-Day Attack
cyberpress.org · 17d ago · September 26th, 2026
The warning affects organizations using Kiteworks’ secure file-transfer and communications products, which enterprises and public-sector entities widely use to exchange sensitive data. East Coast were reportedly given a 10:00 p.m. Administrators were also encouraged to power down systems before the designated period where possible. The company’s support team reportedly described the action as protection against “potential zero-day attacks,” suggesting the threat may involve an unknown vulnerability with no available patch. However, Kiteworks has not publicly confirmed that a zero-day flaw exists, has been exploited, or has been assigned a CVE identifier. The company said it addr
-
update from gbhackers.com
Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat
gbhackers.com · 17d ago · September 26th, 2026
The secure file-sharing and managed content communications provider asked organizations […] The post Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by www.bleepingcomputer.com
Kiteworks urges 6-hour server shutdown over potential zero-day attacks Source: BleepingComputer Read: https://www. bleepingcomputer.com/news
www.bleepingcomputer.com · 17d ago · September 26th, 2026
-
update from dev.to
TL;DR what: Kiteworks asked customers to shut down their systems for nine hours this... # cybersecurity # infosec # security # software # co
dev.to · 17d ago · September 26th, 2026
cybersecurity # infosec # security # software # co
via Mastodon https://dev.to/etairos/kiteworks-tells-customers-to-go-dark-for-9-hours-on-a-federal-tip-1o2o
-
mentioned by thehackernews.com
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack Source: The Hacker News Read: https:// thehackernews.c
thehackernews.com · 17d ago · September 26th, 2026
-
mentioned by cyber.netsecops.io
📰 Kiteworks Urges Shutdown After Warning of Imminent Cyberattack Kiteworks issues urgent advisory for customers to shut down servers for 6-9
cyber.netsecops.io · 16d ago · September 27th, 2026
-
mentioned by gbhackers.com
Kiteworks Urges Customers to Shut Down Servers Over Potential Zero-Day Threat
gbhackers.com · 15d ago · September 28th, 2026
-
update from cyberpress.org
Kiteworks Warns Customers to Shut Down Servers Over Potential Zero-Day Attack
cyberpress.org · 15d ago · September 28th, 2026
The San Mateo, California-based secure data exchange provider issued the advisory on September 25, 2026, recommending a nine-hour shutdown window in customers’ respective local time zones. The vendor said it had no indication that its infrastructure or customer deployments had been compromised. Early reports, including information o
-
update from securityweek.com
Kiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability
securityweek.com · 15d ago · September 28th, 2026
On Sunday, the company announced it had lifted the shutdown recommendation for all customers, and that they could bring their systems back online. “Customers with self-hosted Advanced Forms should contact Customer Support for assistance. All systems Kiteworks hosts on customers’ behalf have been brought back up and are operating normally,” the company said. While Kiteworks’s announcement did not detail the threat, the company said in emails to its customers that a severe vulnerability in its Advanced Forms secure data collection product triggered the shutdown. “Advanced Forms is enabled for fewer than 1% of our customers, under 50 organizations, and the vulnerability is confined to that product only. All other products, including the DPE, file collaboration, file transfer, email encryption, APIs, and MFT, are unaffected,” a copy of the email shared on Reddit reads. The company said it had no evidence the security defect was exploited and that it was working with “industry partners, including Mandiant, to share intelli
-
mentioned by linuxmint.hu
Kiteworks, as a precaution, recommends a nine-hour shutdown to customers over an impending cyberattack threat
linuxmint.hu · 15d ago · September 28th, 2026
-
update from www.heise.de
Could the servers be brought back up? Shut your servers down on Saturday morning: Kiteworks warns admins about the zero-day
www.heise.de · 15d ago · September 28th, 2026
Shut your servers down on Saturday morning: Kiteworks warns admins about the zero-day | Security
via Mastodon https://www.heise.de/news/Bevorstehender-Zero-Day-Angriff-KiteWorks-draengt-Kunden-zur-Serverabschaltung-11466114.html
-
update from bleepingcomputer.com
Kiteworks patches critical flaw, brings customer systems online
bleepingcomputer.com · 14d ago · September 29th, 2026
Shadowserver had spotted nearly 400 internet-accessible Kiteworks instances, mostly from the United States (234), but the dashboard provides no information on how many are honeypots or already patched.
-
update from bleepingcomputer.com
Kiteworks patches critical flaw, brings customer systems online
bleepingcomputer.com · 14d ago · September 29th, 2026
Formerly known as Accellion, it operates a Private Content Network (PCN) that integrates enterprise email, file sharing, Managed File Transfer (MFT), APIs, and web forms into a single platform. Kiteworks provides services to thousands of global corporations and government agencies, and its Private Data Network has over 100 million end-users. "Continuous monitoring throughout the period showed no abnormal activity, and the company has no indication that any Kiteworks or customer system was compromised," Kiteworks said . "Kiteworks developed and de
-
update from cyberscoop.com
Kiteworks lifts shutdown advisory after ‘credible threat intelligence’ from federal authorities
cyberscoop.com · 14d ago · September 29th, 2026
The recommendation, issued last week, advised customers to take production systems offline ahead of a potential imminent attack. “Telling customers to take production systems offline is not a decision any vendor makes lightly, and we knew exactly what we were asking of them,” Chief Information Security Officer Frank Balonis said in the company’s statement. “We made it anyway, because when the choice is between certainty and convenience, customer data is not something we are willing to gamble with.” During the shutdown, Kiteworks discovered a previously unknown critical vulnerability in Advanced Forms, a secure data collection tool used by fewer than 1% of its customers, a group the company said comprises approximately 50 organizations.
-
update from www.kiteworks.com
The announcement was made yesterday. Kiteworks Difficult and Unique Decision to Ensure Customer Data Protection Through Customer-Wide Shutdo
www.kiteworks.com · 14d ago · September 29th, 2026
Kiteworks Difficult and Unique Decision to Ensure Customer Data Protection Through Customer-Wide Shutdo
via Mastodon https://www.kiteworks.com/company/press-releases/kiteworks-restores-systems-credible-threat/
-
update from beyondmachines.net
Kiteworks Patches Critical Vulnerability Following Federal Threat Warning Kiteworks initiated a global system shutdown after federal authori
beyondmachines.net · 13d ago · September 30th, 2026
Kiteworks Patches Critical Vulnerability Following Federal Threat Warning Kiteworks initiated a global system shutdown after federal authori
via Mastodon https://beyondmachines.net/event_details/kiteworks-patches-critical-vulnerability-following-federal-threat-warning-0-p-q-e-7/gD2P6Ple2L