Kiteworks Fixes Critical Flaw Found During Nine-Hour Precautionary Shutdown
Summary: Kiteworks, formerly Accellion, told customers to take systems offline for nine hours and shut down customer-hosted environments after receiving intelligence about a potential imminent cyber attack, and during that window found a previously unknown critical vulnerability confined to a capability enabled for less than 1% of its customer base. The company developed and deployed a fix during the shutdown, added a protective layer across all environments, said there is no evidence the flaw was ever exploited, and lifted the shutdown recommendation on September 27, 2026, without disclosing details or assigning a CVE identifier.
Bottom line: A vendor asked its entire customer base to take production systems offline on threat intelligence alone, before any flaw was confirmed or any breach observed - and the flaw it then found affects under 1% of customers, which is the ratio a security leader has to weigh when deciding whether to follow such a request.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026