# Kiteworks Urges Global Customers to Shut Down Servers for 6-9 Hours Over Federally-Warned Potential Zero-Day Targeting

> Kiteworks, a secure file-sharing/managed-file-transfer (MFT) vendor formerly known as Accellion, told customers worldwide it received credible threat intelligence from federal intelligence/law-enforcement authorities that a threat actor may attempt to target Kiteworks systems, and asked all customers to take systems offline for a 6-9 hour precautionary window on September 26, 2026. Kiteworks says it has found no evidence of any actual compromise, no CVE has been assigned, and the current release (9.5.1) addresses all previously known vulnerabilities.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2670
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-kiteworks-zero-day-precaution-tl-2026-2670.webp?v=c267e2f2 (Threadlinqs threat intel: CVE-2026-23514 Kiteworks Shutdown: Analysis & Hunting (TL-2026-2670) — High severity, 12 IOCs, 9 detection rules.)
- **ID:** TL-2026-2670
- **Severity:** HIGH
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12
- **CVEs:** CVE-2026-23514, CVE-2026-23635, CVE-2026-24752, CVE-2026-24753

## Description

On September 25, 2026, Kiteworks CISO Frank Balonis emailed customers stating the company had received 'credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems,' and that the company had 'no indication that Kiteworks or our customers' systems have been compromised' -- characterizing the guidance explicitly as preventative rather than a response to a confirmed breach. The advisory, first reported by German outlet Heise and then confirmed directly to BleepingComputer, instructed customers to take their Kiteworks deployments offline during a regional window (e.g., 04:00-10:00 CET / 22:00 Fri-04:00 EDT in New York), spanning time zones from Australian Eastern Standard Time to Pacific Daylight Time. Kiteworks explicitly told customers to shut down even systems that are not directly internet-exposed, stating 'potential access paths' could not be ruled out. Self-managed customers (on-premises, AWS, or Azure) were told to perform the shutdown themselves; Kiteworks said it would shut down its own hosted customer instances on their behalf. The company's own press release confirmed its acquired subsidiary products -- Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder -- are not affected by the advisory, implying the concern is scoped to the core Kiteworks platform (Secure File Sharing, Managed File Transfer, Email Protection, Secure Data Forms/Private Data Network, and Sensitive Content Communications). No CVE identifier, exploitation technique, affected component, or IOC was disclosed publicly. TechCrunch reported that CISA spokesperson Marco DiSandro declined to comment on the record and that the FBI also declined to comment when asked about the alert, and cited security researcher Kevin Beaumont's estimate of roughly 1,000 internet-facing Kiteworks instances (likely an undercount of total deployments). Multiple outlets noted this advisory lands against the backdrop of a well-documented pattern: Kiteworks' predecessor product, Accellion FTA, was mass-exploited via multiple zero-days by the Cl0p extortion actor (tracked as UNC2546) in December 2020-January 2021, and Cl0p has since repeated the same MFT zero-day extortion playbook against Fortra GoAnywhere (CVE-2023-0669, Feb 2023), Cleo Harmony/VLTrader/LexiCom (CVE-2024-55956, Dec 2024), and Oracle E-Business Suite (CVE-2025-61882, late 2025) -- none of which is confirmed to be connected to this advisory. Separately, Kiteworks itself disclosed and patched four vulnerabilities in its Secure Data Forms and Core components earlier in 2026: CVE-2026-23514 (Core access-control bypass, CVSS 8.8, fixed in 9.2.2), CVE-2026-23635 (Secure Data Forms unprotected credential transport, CVSS 6.5, fixed in 9.2.1), CVE-2026-24752 (Secure Data Forms reflected XSS, CVSS 8.2, fixed in 9.3.0), and CVE-2026-24753 (Secure Data Forms IDOR/authorization bypass, CVSS 6.5, fixed in 9.3.0). Kiteworks states the current 9.5.1 release addresses all of these; none is confirmed as the subject of the September 2026 shutdown advisory. Customer guidance issued alongside the shutdown included preserving authentication, application, web-server, endpoint, and network logs before restart; restricting administrative access; and reviewing for unusual file-transfer activity, unexpected authentication events, and unexplained privilege changes after systems come back online.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1059.007 JavaScript
- T1505.003 Web Shell
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1565.001 Stored Data Manipulation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Kiteworks Web-Shell Persistence & Post-Exploitation Account/Privilege Abuse** (`TL-2026-2670-SPL-002`)

Detects an application-server process (IIS w3wp.exe, Java/Tomcat) spawning a command interpreter or scripting engine -- a classic web-shell indicator -- together with Windows privileged-group membership changes or Kiteworks admin-audit role/permission changes, consistent with post-exploitation persistence and privilege escalation following compromise of an internet-facing Kiteworks server.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1098, T1078
- **Data sources:** windows_security, sysmon, kiteworks_admin_audit_log
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=win_security OR index=sysmon) sourcetype IN ("WinEventLog:Security","XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
(EventCode=1 AND (ParentImage="*\\w3wp.exe" OR ParentImage="*\\java.exe" OR ParentImage="*\\tomcat9.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe"))
OR (EventCode IN (4720,4728,4732,4756))
OR sourcetype="kiteworks:admin_audit" (action="role_change" OR action="permission_grant")
| eval technique=case(
    EventCode=1, "T1505.003 webshell_spawned_process",
    EventCode IN (4720,4728,4732,4756), "T1098 account_manipulation",
    sourcetype="kiteworks:admin_audit", "T1078 valid_account_privilege_change")
| stats count values(technique) as mitre_techniques by host, user, _time
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","java.exe","tomcat9.exe")
| where FileName in~ ("cmd.exe","powershell.exe","wscript.exe","cscript.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| union (
    AuditLogs
    | where TimeGenerated > ago(24h)
    | where OperationName in ("Add member to role","Add app role assignment to service principal","Update user")
    | project Timestamp = TimeGenerated, DeviceName = tostring(""), InitiatingProcessFileName = tostring("kiteworks_admin_audit"), FileName = OperationName, ProcessCommandLine = tostring(TargetResources), AccountName = tostring(InitiatedBy.user.userPrincipalName)
)
| summarize EventCount = count() by AccountName, DeviceName, bin(Timestamp, 1h)
| where EventCount > 0
```

### Sigma

```yaml
title: Command Interpreter Spawned by Kiteworks Application-Server Process
id: 5b7c8d9e-2f30-4142-9536-7b8c9d0e1f20
status: experimental
description: Detects w3wp.exe/java.exe/tomcat9.exe spawning cmd.exe, powershell.exe, wscript.exe, or cscript.exe — a web-shell persistence indicator.
references:
    - https://attack.mitre.org/techniques/T1505/003/
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.privilege-escalation
    - attack.t1098
    - attack.defense-evasion
    - attack.t1078
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\java.exe'
            - '\tomcat9.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate app-server maintenance scripts
    - Scheduled backup/health-check jobs
level: high
```

**Known false positives:**

- Legitimate Kiteworks maintenance/patch scripts invoked by the app-server service account
- Scheduled backup jobs or health-check scripts launched from the app-server process

**Tuning notes:** Exclude the known service-account SID used for scheduled Kiteworks maintenance; correlate EventCode 4720/4728/4732/4756 with change-management tickets before alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Phishing-Delivered Script Execution Preceding Kiteworks Exploitation Attempt (locked: unlock with TL Creds)
- Session-Token Reuse Across Multiple IPs Followed by Role/Privilege Change (AiTM Indicator) (locked: unlock with TL Creds)
- Anomalous Cloud-App Bulk Download from Kiteworks Consistent with Mass Exfiltration (locked: unlock with TL Creds)
- Kiteworks Secure Data Forms Exploit Attempt / Vulnerability Scan Pattern (locked: unlock with TL Creds)
- Web-Shell-Style Child Process Spawned by Kiteworks Application Server (locked: unlock with TL Creds)
- Sustained Large-Volume Outbound Transfer from MFT Host (Bulk Exfiltration Pattern) (locked: unlock with TL Creds)
- Kiteworks Public-Facing Exploitation & Pre-Attack Vulnerability Scanning (locked: unlock with TL Creds)
- Kiteworks Bulk File-Transfer Egress Consistent with Cl0p Mass-Exfiltration Playbook (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Kiteworks urges 6-hour server shutdown over potential zero-day attacks](https://www.bleepingcomputer.com/news/security/kiteworks-urges-6-hour-server-shutdown-over-potential-zero-day-attacks/)
- [Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack](https://techcrunch.com/2026/09/25/kiteworks-urges-customers-to-shut-down-their-servers-amid-imminent-threat-of-cyberattack/)
- [Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack](https://thehackernews.com/2026/09/kiteworks-urges-customers-to-shut-down.html)
- [Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence From Federal Intelligence Authorities](https://www.kiteworks.com/company/press-releases/kiteworks-precautionary-shutdown-advisory/)
- [Kiteworks zero-day warning prompts shutdown advice](https://cybernews.com/security/kiteworks-cyberattack-imminent-server-shutdown/)
- [Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat](https://gbhackers.com/kiteworks-systems-offline-amid-suspected-zero-day/)
- [Kiteworks Customers Told to Shut Down Servers Over Possible Zero-Day Attack](https://cyberpress.org/kiteworks-customers-told-shut-down-servers/)
- [GHSA-qmv7-28g4-hx9x - Kiteworks Secure Data Forms IDOR (CVE-2026-24753)](https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qmv7-28g4-hx9x)
- [GHSA-9hw2-6qp4-3v8f - Kiteworks Secure Data Forms unprotected credential transport (CVE-2026-23635)](https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9hw2-6qp4-3v8f)
- [NVD - CVE-2026-24752 (Kiteworks Secure Data Forms reflected XSS)](https://nvd.nist.gov/vuln/detail/CVE-2026-24752)
- [CVE-2026-24753 detail - Kiteworks Secure Data Forms Authorization Bypass](https://cvefeed.io/vuln/detail/CVE-2026-24753)
- [CVE-2026-23635 - Kiteworks Information Disclosure Flaw](https://www.sentinelone.com/vulnerability-database/cve-2026-23635/)
- [Kiteworks Core Access Control Vulnerability (CVE-2026-23514)](https://www.thehackerwire.com/kiteworks-core-access-control-vulnerability-cve-2026-23514/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2670