Kiteworks Patches Critical Vulnerability Found During System Shutdown

Kiteworks has patched a critical security vulnerability that was discovered during a precautionary nine-hour shutdown of its systems.

The company stated on Monday that the flaw was identified while working alongside federal intelligence authorities over the weekend. The vulnerability was confined to a specific capability enabled for fewer than 1% of the company’s customer base.

Preventative Shutdown Triggers Discovery

The discovery occurred during a period of downtime initiated on 27 September 2026. Kiteworks, formerly known as Accellion, had urged customers to take production systems offline after receiving intelligence regarding a potential imminent cyberattack.

The company emphasised that the shutdown was a preventative measure rather than a reaction to a confirmed breach of its systems. During the nine-hour window, Kiteworks developed and deployed a fix and applied an additional protective layer across all environments.

No Evidence of Exploitation

Kiteworks confirmed there is currently no evidence that the vulnerability has been exploited in a malicious context. The flaw does not affect other Kiteworks products, and as of writing, it has not been assigned a Common Vulnerabilities and Exposures (CVE) identifier.

Kiteworks CISO Frank Balonis defended the decision to take systems offline, stating that the company prioritised customer data security over operational convenience. “We made it anyway, because when the choice is between certainty and convenience, customer data is not something we are willing to gamble with,” Balonis said.

Following the conclusion of the threat window and the observation that no anomalies occurred, Kiteworks has recommended that customers bring their systems back online.