On September 25, 2026, Kiteworks Chief Information Security Officer Frank Balonis emailed the company's customer base stating that Kiteworks "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems," and separately told customers the intelligence came from "law enforcement indicating an attack on Kiteworks systems may be imminent this weekend." The company asked every customer, regardless of whether their deployment was internet-facing, to take their Kiteworks instance offline during a designated regional window that weekend: a coordinated six-to-nine-hour window reported as 02:00-08:00 UTC / 04:00-10:00 CET / 03:00-09:00 UK time Saturday, September 26, with a separate New York window of 22:00 Friday-04:00 Saturday EDT, and additional windows spanning time zones from Australian Eastern Standard Time (AEST) to Pacific Daylight Time (PDT). Kiteworks-hosted (SaaS) customers required no action, as the vendor handled the shutdown on their behalf; self-managed customers running on-premises, AWS, or Azure deployments had to execute their own shutdown, and TechCrunch reported at least 1,000 internet-facing Kiteworks systems were identified, with one healthcare customer reporting that its immediate shutdown caused delays in patient contact. Kiteworks stated it has "no indication that Kiteworks or our customers' systems have been compromised," characterizing the advisory as preventative rather than a response to a confirmed breach, and said "all known vulnerabilities are addressed" in the current 9.5.1 release, which it urges all customers to run. As of this writing, no CVE identifier has been assigned, no technical details of the suspected vulnerability (attack vector, affected component, or exploitability) have been disclosed, the FBI declined to comment, and CISA spokesperson Marco DiSandro would not comment on the record. German outlet Heise broke the story after obtaining the warning email and confirming details by phone with Kiteworks customer support, which told the outlet: "The reason we're asking you to shut down the servers is to protect against any potential zero-day attacks." Heise also contacted Germany's BSI (Federal Office for Information Security) and BKA (Federal Criminal Police Office) for verification; neither responded immediately. Sophos Counter Threat Unit (CTU) separately issued customer guidance directing Kiteworks customers to follow the vendor's email instructions.

The advisory is notable chiefly because of Kiteworks' own history and its outsized customer base: the company traces its lineage directly to Accellion, whose legacy File Transfer Appliance (FTA), running versions 9_12_370/9_12_411 and earlier, was the subject of a catastrophic zero-day mass-exploitation campaign beginning mid-December 2020. Mandiant (FireEye) attributed the initial exploitation and web-shell deployment to a cluster it tracked as UNC2546, and the follow-on extortion activity -- emails claiming affiliation with the CLOP ransomware brand and threatening publication on a ".onion" shaming site branded "CL0P^_-LEAKS" -- to a related cluster tracked as UNC2582; Mandiant further noted limited infrastructure overlap with the financially motivated group FIN11, observing that a DEWMODE web-shell C2 IP address fell within the "Fortunix Networks L.P." netblock also historically used to host FIN11's FRIENDSPEAK command-and-control domains. UNC2546 chained four vulnerabilities -- CVE-2021-27101 (unauthenticated SQL injection via a crafted HOST header, used for initial access and to retrieve a key enabling execution of the FTA's built-in `admin.pl` utility), CVE-2021-27104 (OS command execution via a crafted POST request), CVE-2021-27102 (OS command execution via a local web service call), and CVE-2021-27103 (server-side request forgery via a crafted POST request) -- to deploy the DEWMODE web shell (installed as `/home/httpd/html/about.html` or `/home/seos/courier/about.html`), which queried the FTA's internal MySQL database for file metadata and then served encrypted download links (`/courier/about.html?dwn={encrypted path}&fn={encrypted filename}`) so operators could selectively exfiltrate files over HTTPS (port 443) to attacker-controlled IP addresses 194.88.104.24 and 45.135.229.179, sanitizing archived Apache logs afterward to remove traces. CISA, the FBI, and international partners (Australia's ACSC, the UK's NCSC, and New Zealand's CERT NZ) documented the campaign, its extortion follow-on, and confirmed impacts across federal, state, local, and private-sector victims in the US, Australia, New Zealand, Singapore, and the UK in Joint Cybersecurity Advisory AA21-055A (published Feb 24, 2021), publicly naming victims including the University of Colorado, the Washington State Auditor's Office, Flagstar Bank, Bombardier, Singtel, Shell, and Kroger. The US State Department's Rewards for Justice program has separately offered a $10 million reward for information linking Clop to a foreign government, underscoring the unresolved attribution and financial motivation behind the campaign. Accellion rebranded to Kiteworks in October 2021 as it pivoted its go-to-market around its "Private Data Network"/enterprise content firewall platform for secure file transfer, managed file transfer (MFT), enterprise webmail, and sensitive-data collaboration.

Multiple outlets covering the 2026 advisory explicitly drew the parallel to the 2020-2021 breach, as well as to subsequent Clop mass-exploitation campaigns against other managed-file-transfer products -- GoAnywhere MFT, SolarWinds Serv-U, Cleo Harmony/VLTrader/LexiCom, and MOVEit Transfer -- framing MFT/secure-file-transfer appliances broadly as a recurring target class for zero-day supply-chain-style extortion campaigns. Independent security researchers were skeptical of the unusual scale of the response: Jake Knott, a senior threat-intelligence official at watchTowr, said "nobody requests that their entire customer base unplug production systems over the weekend" absent a known CVE, patch, or technical detail, adding that "attackers' appetite for targeting [managed file transfer] appliances has not, and we have no reason to believe this time will be any different." Other researchers noted that in the absence of a published CVE, patch, or technical mitigation, full disconnection is the most reliable short-term control available against a potentially exploitable zero-day.

Kiteworks markets itself as protecting over 100 million end users across thousands of enterprises and government agencies, and holds dual U.S. FedRAMP authorization (High and Moderate impact levels), making it widely used by federal agencies, government contractors, financial institutions, healthcare organizations, legal firms, and other regulated industries in government, healthcare, technology, education, and automotive sectors. Kiteworks stated the advisory does not extend to its separately branded subsidiary products: Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder. Given Kiteworks' scale, its FedRAMP footprint, and the platform's documented history of being the target of a nation-state-adjacent, financially motivated mass zero-day campaign, this precautionary advisory is tracked as a HIGH-severity, unconfirmed/preventative threat pending either a CVE assignment, technical advisory, or confirmation (or ruling-out) of active exploitation.