Kiteworks (formerly Accellion) said on 25 September 2026 that it had received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems, and advised customers to facilitate a precautionary nine-hour shutdown window that weekend, in their local time zone. Customers who self-manage Kiteworks (on-premises or on AWS or Azure) were asked to shut down their own systems, and Kiteworks said it would shut down the systems it hosts on customers' behalf.

CISO Frank Balonis said Kiteworks had no indication that Kiteworks or customer systems had been compromised, that the advisory was preventative, and that all known vulnerabilities were addressed in the current release, 9.5.1.

Kiteworks said the threat does not affect its subsidiaries (source: Kiteworks).

UPDATE 27 Sep 2026: Kiteworks' notice says that as of 27 September the shutdown recommendation is lifted for all customers, that all systems Kiteworks hosts on customers' behalf have been brought back up, and that customers with self-hosted Advanced Forms should contact Customer Support (source: Kiteworks).

UPDATE 29 Sep 2026: BleepingComputer reports that the shutdown was prompted by a critical vulnerability in an unnamed feature used by less than 1% of all customers, and quotes Kiteworks: "Kiteworks developed and deployed a fix during the window, applied an additional protective layer across all environments, and has no indication the vulnerability was ever exploited. All other Kiteworks products were unaffected."

No CVE ID had been assigned, according to BleepingComputer (source: BleepingComputer).

Correction (29 Oct 2026): removed details that only SecurityWeek or customer emails posted on Reddit gave, which no readable source states; also removed SecurityWeek credits, internal source labels and a duplicate Kiteworks link, and dated the updates. (sources: Kiteworks; BleepingComputer)