Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

By George Bailey   Published: 09/29/26   4 min read
Cybersecurity

Most vendors do not ask customers to switch production off for a weekend. Kiteworks did. After what it called credible threat intelligence from federal intelligence authorities, the secure file-sharing company (formerly Accellion) recommended a precautionary nine-hour shutdown of on-premises and customer-hosted systems, then lifted that advice on Sunday, September 27.

Systems are back up. The question for Tuesday is simple: are you on the current release, and do you run the one product the company says is affected?

When a file-transfer vendor asks everyone to unplug, the right follow-up is not relief. It is an inventory.

What happened

Kiteworks emailed customers late last week recommending a shutdown window over the weekend, first reported by German outlet Heise. Customers running Kiteworks on-premises or in their own AWS or Azure accounts were asked to power down during that window; Kiteworks shut down the systems it hosts on customers’ behalf itself. A Kiteworks support official told Heise the advisory was tied to a potential zero-day.

On Sunday the company lifted the recommendation. In emails to customers, it said a severe vulnerability in its Advanced Forms secure data collection product triggered the shutdown. Advanced Forms is enabled for fewer than 1% of customers, under 50 organizations, and Kiteworks says the other products (file collaboration, file transfer, email encryption, APIs, and MFT) are unaffected. Customers with self-hosted Advanced Forms were told to contact Kiteworks support.

Kiteworks CISO Frank Balonis said the company has no indication that Kiteworks or customer systems were compromised, that the advisory was preventative, and that all known vulnerabilities are addressed in the current release, 9.5.1. The company is working with partners including Mandiant. No CVE or technical details have been published.

Why it matters

Secure file transfer and file-sharing platforms have been extortion targets for years because they hold exactly what a data-theft crew wants in one place. Kiteworks knows this history better than most: in December 2020, Clop used a zero-day in Accellion’s file transfer appliance to steal data from dozens of organizations. watchTowr’s Jake Knott told The Record that nobody asks an entire customer base to unplug production systems over a weekend on a hunch.

The good news is scope. If you do not use Advanced Forms, the company says you are not affected by this flaw. If you do, the product is small enough that your support conversation should be quick.

What to do first

Forward this

If we use Kiteworks for secure file sharing: please confirm we are on version 9.5.1 and tell me whether we use the Advanced Forms feature. Kiteworks asked customers to shut down over the weekend after a federal warning and says the flaw is limited to Advanced Forms.

Details

Hunt / verify

Slack paste: Kiteworks: confirm 9.5.1 everywhere; check if Advanced Forms is enabled (if self-hosted, open a support ticket today); keep weekend logs for any node that stayed online.

Sources

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.