Advisories
Kiteworks Advises 9‑Hour System Shutdown Amid Credible Threat Intelligence
Kiteworks (formerly Accellion) has instructed customers to shut down their systems for a nine‑hour window over the weekend after receiving credible threat intelligence that a threat actor may target its platform. The advisory is preventative; no compromise evidence has been found. Defenders should apply the latest 9.5.1 patch, observe the shutdown window, and monitor for anomalous activity.
What Happened
Kiteworks received credible threat intelligence from federal intelligence authorities that a threat actor may attempt to target some Kiteworks systems. In response, the company issued a direct advisory to customers, recommending a nine‑hour shutdown over the weekend to mitigate potential risk.
Impact
No evidence of compromise has been reported. The advisory applies only to Kiteworks’ core platform; subsidiaries such as Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder are not affected.
Recommended Actions
- Apply the latest 9.5.1 patch immediately to ensure all known vulnerabilities are addressed.
- Observe the specified nine‑hour shutdown window as communicated via the company’s email.
- During the shutdown, disable external access to Kiteworks services and monitor internal logs for any anomalous activity.
- After the window, verify system integrity and confirm no unauthorized changes or data exfiltration.
Additional Notes
"Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we continue to work through the matter with federal intelligence authorities," said Frank Balonis, CISO at Kiteworks.
Related vulnerabilities
Kiteworks Identifies & Remediates Critical Vulnerability During Nine‑Hour Shutdown
During a precautionary nine‑hour shutdown, Kiteworks uncovered a critical flaw in a feature used by less than 1% of customers. A patch and additional protective layer were deployed, with no evidence of exploitation. Defenders should confirm their systems are patched and review the affected capability.
Read briefing
Microsoft Office Word CVE-2026-108439 RCE – Omitted from October 2026 Patch
Microsoft identified that the October 2026 security update for Office Word did not list CVE‑2026‑108439, a remote code execution flaw. The patch already contains the fix, so systems that applied the October 2026 updates are protected. Defenders should verify that the October 2026 update is installed and monitor for any unpatched environments.
Read briefing
CVE-2026-70179: ASP.NET Core Elevation of Privilege – Informational Update
Microsoft has released an informational update for CVE-2026-70179, an elevation of privilege flaw in ASP.NET Core. The update adds download and KB article links for Visual Studio, but the fixed builds remain unchanged. Defenders should verify that their ASP.NET Core deployments are on patched versions and review the updated documentation.
Read briefing
CVE‑2026‑108455: PowerPoint Information Disclosure – Update Omission Clarified
Microsoft Office PowerPoint’s information disclosure vulnerability (CVE‑2026‑108455) was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. Defenders should verify the update is installed; no further action is required if already updated.
Read briefing