Kiteworks patches critical flaws after federal threat shutdown

After a federal threat warning and precautionary shutdown, Kiteworks patched a critical Advanced Forms bug and later 126 flaws, with no exploitation reported.

Kiteworks, formerly Accellion, resumed operations after a precautionary shutdown prompted by credible federal threat intelligence of a possible imminent attack. CyberScoop described the outage as weekend-long and said the company found and patched a previously unknown critical Advanced Forms vulnerability affecting fewer than 1% of customers, about 50 organizations, in release 9.5.1; The Hacker News called it a nine-hour shutdown lifted on September 27, 2026, said no CVE had been assigned, and reported an added protective layer across all environments. Both early accounts and later coverage said there was no evidence of exploitation. On October 1–2, BleepingComputer and Cyber Security News reported a broader fix for 126 vulnerabilities in Core, Email Protection Gateway, and Secure Data Forms, including maximum-severity CVE-2026-54154, an unauthenticated code-injection flaw in Email Protection Gateway before 9.4.1 that can yield root, plus critical account-takeover and related flaws addressed in 9.5.0 or 9.5.1. Canada's Cyber Centre advisory AV26-988 lists builds before 9.5.0 and 9.5.1 but names no CVEs; sources disagree on shutdown length and on public identifiers, while none reported active exploitation and Shadowserver was said to track nearly 400 exposed instances.