Kiteworks Security Patch Allows Customer Systems to Return Online

A Kiteworks security patch has addressed a critical vulnerability following a precautionary shutdown of customer systems. The company has lifted its shutdown recommendation and says monitoring found no evidence of compromise or suspicious activity.

Shutdown Recommendation Ends After Threat Review

Kiteworks initially urged customers to take their systems offline after federal intelligence authorities warned of a potentially imminent cyberattack.

The company later updated its advisory to lift that recommendation effective September 27. It told customers they could restart systems that remained offline.

Meanwhile, a Monday announcement confirmed that all hosted customer systems had returned online.

According to Kiteworks, continuous monitoring detected no abnormal activity during the shutdown period. The company also said it had no indication that attackers compromised its own systems or customer environments.

Critical Flaw Affected a Limited Feature

During the shutdown window, Kiteworks developed and deployed a fix for a critical vulnerability.

The company said the flaw involved a feature that fewer than 1% of customers used. However, it did not publicly identify that feature or explain the technical weakness.

Separately, Kiteworks instructed customers running self-hosted Advanced Forms to contact support for assistance.

The company also added another protective layer across its environments. It said all other Kiteworks products remained unaffected and reported no indication that anyone had exploited the vulnerability.

Technical Details Remain Unavailable

The Kiteworks security patch announcement did not include a CVE identifier or a detailed description of the flaw.

Consequently, the public information does not establish how an attacker could exploit it or which technical conditions would enable an attack.

Shadowserver identified nearly 400 internet-accessible Kiteworks instances, including 234 in the United States.

However, those figures do not represent a confirmed count of vulnerable systems. The available data does not show which instances had received updates or whether some were honeypots.

File-Sharing Platforms Hold Sensitive Business Data

Kiteworks serves thousands of companies and government agencies. Its platform combines services such as enterprise email, file sharing, managed file transfers, APIs and web forms.

Because these systems handle sensitive documents, attackers have repeatedly targeted weaknesses in enterprise file-transfer software for data theft and extortion.

Kiteworks previously operated under the Accellion name. During that period, the Clop gang exploited vulnerabilities in its legacy File Transfer Appliance product.

That earlier campaign affected organizations including Shell, Qualys, Kroger and the Reserve Bank of New Zealand.

However, those historical breaches involved a separate legacy product. They do not establish any connection to the newly patched vulnerability or confirm an attack against current Kiteworks customers.

Self-Hosted Advanced Forms Customers Should Contact Support

The company’s updated advisory permits customers to bring their systems back online.

Nevertheless, its specific instruction for self-hosted Advanced Forms customers remains relevant: contact Kiteworks support for further assistance.

For now, Kiteworks describes the shutdown as a precautionary response to credible threat information. Its investigation and monitoring have not identified a successful compromise.