Kiteworks lifts precautionary shutdown after patching critical flaws

After a federal warning, Kiteworks ran a brief precautionary shutdown, patched a critical Advanced Forms flaw and CVE-2026-54154, and reported no compromise.

Kiteworks, formerly Accellion, told customers to take servers offline after federal or law-enforcement intelligence warned of a possible imminent attack, which early accounts described as a potential unknown zero-day. Sources disagree on timing and duration: some place the order on Friday, September 25, 2026, others on Saturday, September 26, and they describe a six-hour window from 02:00 to 08:00 UTC, about nine hours, or a weekend-long precaution. CISO Frank Balonis said there was no evidence of compromise, no actor or attack path was named, and the advice covered self-managed on-premises, AWS, and Azure deployments as well as systems that were not internet-exposed; hosted environments were later restored, and Zivver, DRACOON, and ownCloud were said to be unaffected. On September 27 the company lifted the shutdown recommendation and said it had patched a previously unknown critical flaw in Advanced Forms, enabled for fewer than 1% of customers and under about 50 organizations, in release 9.5.1, with no CVE and no sign of exploitation, while sharing intelligence with partners including Mandiant. A later report said a separate-sounding update fixed 126 issues, including maximum-severity CVE-2026-54154 in Email Protection Gateway before 9.4.1, which can allow unauthenticated remote code execution and root access, plus 11 other critical Core and EPG flaws; sources do not explicitly identify that CVE as the Advanced Forms bug. Shadowserver tracked nearly 400 exposed instances, 234 in the United States, and Clop had previously exploited Accellion file-transfer zero-days in 2020–2021.