--- title: Kiteworks patches critical flaw, brings customer systems... description: Kiteworks (formerly Accellion) lifted its precautionary shutdown advisory after finding no evidence of compromise following a warning from federal intelligence... canonical: https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kiteworks patches critical flaw, brings customer systems online | daily.dev og:description: Kiteworks (formerly Accellion) lifted its precautionary shutdown advisory after finding no evidence of compromise following a warning from federal intelligence... og:url: https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e og:image: https://api.daily.dev/og/posts/AAsBal74e.png og:image:alt: Kiteworks patches critical flaw, brings customer systems online og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kiteworks patches critical flaw, brings customer systems online **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Kiteworks (formerly Accellion) lifted its precautionary shutdown advisory after finding no evidence of compromise following a warning from federal intelligence authorities about a potentially imminent attack. The company patched a critical vulnerability affecting an unnamed feature used by fewer than 1% of customers, specifically self-hosted Kiteworks Advanced Forms, and applied additional protective measures across all environments. No CVE has been assigned yet. Shadowserver identified nearly 400 internet-exposed Kiteworks instances, mostly in the US. The company has a history tied to Accellion FTA breaches exploited by the Clop gang in 2021, which affected Qualys, Shell, Kroger, and other high-profile organizations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened with the Kiteworks shutdown advisory and vulnerability patch? Kiteworks lifted its precautionary shutdown advisory on September 27th after patching a critical vulnerability in an unnamed feature used by less than 1% of customers, specifically affecting self-hosted Kiteworks Advanced Forms. The advisory had been issued after a warning from federal intelligence authorities about a potentially imminent cyberattack. No CVE ID has been assigned, and the company found no evidence any system was compromised or the flaw exploited. _Track emerging file-sharing platform vulnerabilities and patch advisories on daily.dev as they develop._ ### How many Kiteworks instances are exposed to the internet and at risk? Shadowserver identified nearly 400 internet-accessible Kiteworks instances, with 234 located in the United States. The exact number of unpatched or vulnerable systems is unclear, since the count includes potential honeypots and instances that may have already been patched following the company's fix. _Security teams monitoring exposed enterprise software can follow exposure data trends like this on daily.dev._ ### Why do cybercriminals target file-sharing platforms like Kiteworks and Accellion? File-sharing and managed file transfer platforms store sensitive documents, making them prime targets for data-theft extortion attacks. The Clop extortion gang previously exploited zero-day vulnerabilities in the legacy Accellion FTA software, leading to breaches at Qualys, Shell, Kroger, Singtel, the Reserve Bank of New Zealand, and multiple universities, with fewer than 100 of 300 FTA customers affected but two dozen suffering significant data theft. _Anyone assessing file-transfer platform risk can keep up with disclosed extortion campaigns via daily.dev._ ## Similar posts on daily.dev - [When One Vulnerability Breaks the Internet and Millions of Devices Join In](https://daily.dev/posts/when-one-vulnerability-breaks-the-internet-and-millions-of-devices-join-in-rmhnf223x) · Security Boulevard · 0 upvotes · 0 comments - [CISA: Ransomware gangs now exploiting critical TeamCity flaw](https://daily.dev/posts/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw-ivphb8400) · BleepingComputer · 1 upvotes · 0 comments - [Cisco serves up yet another perfect 10 bug with Secure Workload admin flaw](https://daily.dev/posts/cisco-serves-up-yet-another-perfect-10-bug-with-secure-workload-admin-flaw-xflpzpsaf) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kiteworks patches critical flaw, brings customer systems online","url":"https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e"},"datePublished":"2026-09-29T09:08:54.517Z","dateModified":"2026-10-02T17:05:19.823Z","description":"Kiteworks (formerly Accellion) lifted its precautionary shutdown advisory after finding no evidence of compromise following a warning from federal intelligence...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99f8acda069ebca251b47630d651ed41?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/99f8acda069ebca251b47630d651ed41?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Kiteworks patches critical flaw, brings customer systems online"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kiteworks-patches-critical-flaw-brings-customer-systems-online-aasbal74e#faq","mainEntity":[{"@type":"Question","name":"What happened with the Kiteworks shutdown advisory and vulnerability patch?","acceptedAnswer":{"@type":"Answer","text":"Kiteworks lifted its precautionary shutdown advisory on September 27th after patching a critical vulnerability in an unnamed feature used by less than 1% of customers, specifically affecting self-hosted Kiteworks Advanced Forms. The advisory had been issued after a warning from federal intelligence authorities about a potentially imminent cyberattack. No CVE ID has been assigned, and the company found no evidence any system was compromised or the flaw exploited. Track emerging file-sharing platform vulnerabilities and patch advisories on daily.dev as they develop."}},{"@type":"Question","name":"How many Kiteworks instances are exposed to the internet and at risk?","acceptedAnswer":{"@type":"Answer","text":"Shadowserver identified nearly 400 internet-accessible Kiteworks instances, with 234 located in the United States. The exact number of unpatched or vulnerable systems is unclear, since the count includes potential honeypots and instances that may have already been patched following the company's fix. Security teams monitoring exposed enterprise software can follow exposure data trends like this on daily.dev."}},{"@type":"Question","name":"Why do cybercriminals target file-sharing platforms like Kiteworks and Accellion?","acceptedAnswer":{"@type":"Answer","text":"File-sharing and managed file transfer platforms store sensitive documents, making them prime targets for data-theft extortion attacks. The Clop extortion gang previously exploited zero-day vulnerabilities in the legacy Accellion FTA software, leading to breaches at Qualys, Shell, Kroger, Singtel, the Reserve Bank of New Zealand, and multiple universities, with fewer than 100 of 300 FTA customers affected but two dozen suffering significant data theft. Anyone assessing file-transfer platform risk can keep up with disclosed extortion campaigns via daily.dev."}}]} ```