Enterprise Account Executive

Kiteworks security patch fixes critical code injection vulnerability. Post Views: 3 Kiteworks resolves 126 security vulnerabilities, including a high-severity flaw in its Protection Gateway component. Overview of the vulnerabilities. Kiteworks, a secure file-sharing platform, has issued patches to address 126 security flaws across its product suite. The most critical issue, a high-severity vulnerability in the Protection Gateway (EPG) security solution, could allow remote code execution. The EPG is a core part of the Kiteworks Private Content Network (PCN), which consolidates enterprise file transfer, secure sharing, and API integrations. Key vulnerabilities identified. The resolved issues include 11 critical vulnerabilities in the Core and EPG components. These encompass authentication bypass flaws, admin account takeover risks, stored cross-site scripting (XSS) vulnerabilities, and improper access control mechanisms. Details of the high-severity flaw. The most severe flaw, designated CVE-2026-54154, was disclosed via Kiteworks' YesWeHack bug bounty program. Exploitation allows unauthenticated attackers to execute arbitrary code on EPG appliances through path traversal, code injection, and authentication gaps. The attack chain requires no user interaction and operates with low complexity, enabling full administrative control of the system. Impact and mitigation. The flaw affects all EPG releases prior to version 9.4.1. Mitigation is available in updates 9.4.1 and later. Kiteworks' advisory noted that the vulnerability stems from input-handling weaknesses in publicly accessible endpoints, which could permit remote code execution and privilege escalation to root-level access. Previous actions and current status. Kiteworks previously issued a temporary shutdown directive for customer servers following threat intelligence about an imminent zero-day exploit. This precaution was lifted on Monday after critical vulnerabilities were addressed, with the firm confirming no signs of compromise or malicious activity in affected systems. Unassigned CVE identifier. Despite the patch deployment, Kiteworks has not yet assigned a Common Vulnerabilities and Exposures (CVE) identifier for the fixed flaw, complicating tracking efforts. Shadowserver, a cybersecurity monitoring organization, reports approximately 400 Kiteworks instances exposed to the internet, though it has not disclosed how many have been patched or if any represent honeypot setups. Related security incidents. The updates follow recent disclosures of similar vulnerabilities in other platforms, including a critical Roundcube flaw exploited for code injection attacks and a separate incident involving compromised Pentagon personnel data. Security agencies have also issued warnings about pre-authentication remote code execution flaws in MikroTik RouterOS, underscoring ongoing challenges in securing enterprise infrastructure. "The vulnerability stems from input-handling weaknesses in publicly accessible endpoints, which could permit remote code execution and subsequent privilege escalation to root-level access," according to Kiteworks' advisory.

Citrix, tax data theft and new tricks from Star Blizzard. Citrix NetScaler admins have a new headache, with a critical CVE-2026-88772 memory overflow bug in DTLS handling now fully dissected and already under active attack. If you run NetScaler ADC or Gateway, you should confirm you are on the patched release and check for any odd traffic on exposed appliances. France's tax authority has disclosed that an attacker used stolen staff passwords to pull data on hundreds of thousands of taxpayers and businesses over seven weeks, and neither the tax administration nor ANSSI spotted the exfiltration in real time. This is a reminder to clamp down on weak passwords, enforce MFA for staff with access to finance or tax systems, and review how you detect large or unusual data transfers. Researchers have detailed a new Spectre v2 variant called Branch Target Reuse that can leak Linux memory from JIT engines in browsers, runtimes, and even the kernel across several CPU vendors. For most small teams this is one for your OS and browser patch cycle, but if you run multi tenant Linux hosts you should track vendor guidance on Spectre style mitigations. Russian group Star Blizzard is sending fake event invitations to people linked to Ukraine to push a Windows backdoor, with Microsoft seeing more than 100 affected organisations since January, mainly in the US and UK. It is a good time to remind staff to treat unsolicited invites with care and to tighten mail filtering and endpoint controls for macro like or script based payloads. Kiteworks has shared that a scheduled nine hour precautionary shutdown led to the discovery of a critical flaw in a feature used by less than 1% of customers, which they fixed while working with federal intelligence agencies. If you use Kiteworks, check their advisory and version, and more broadly consider whether your own file transfer or sharing tools have a clear patch and incident process.

Kiteworks lifts shutdown advisory after 'credible threat intelligence' from federal authorities. The company said it found and patched a previously unknown critical vulnerability in one product during the weekend shutdown, and has no indication it was exploited. September 29, 2026 Kiteworks, a provider of secure file transfer and data-sharing tools, told customers Monday they could resume normal operations after a weekend-long precautionary shutdown prompted by what it called "credible threat intelligence" from federal authorities. The recommendation, issued last week, advised customers to take production systems offline ahead of a potential imminent attack. The company also shut down the environments it hosts on customers' behalf. By Sunday, Kiteworks said continuous monitoring showed no abnormal activity. "Telling customers to take production systems offline is not a decision any vendor makes lightly, and we knew exactly what we were asking of them," Chief Information Security Officer Frank Balonis said in the company's statement. "We made it anyway, because when the choice is between certainty and convenience, customer data is not something we are willing to gamble with." During the shutdown, Kiteworks discovered a previously unknown critical vulnerability in Advanced Forms, a secure data collection tool used by fewer than 1% of its customers, a group the company said comprises approximately 50 organizations. The company said its other products, including file collaboration, file transfer, email encryption and managed file transfer, were unaffected. Kiteworks said it developed and deployed a fix during the window and has no indication the vulnerability was ever exploited. All known vulnerabilities are addressed in release 9.5.1, which the company recommends customers run. Company CEO Jonathan Yaron said in a release that being proactive about the threat was top of mind. "Our customers gave up their weekend on our recommendation, at short notice and at difficult hours, and many of their teams worked through the night alongside ours," Yaron said. "The industry standard is to wait for proof of an attack. We would rather be proactive on credible warning than wait for certainty and be too late. That is the standard we intend to keep." Kiteworks, a California-based company formerly known as Accellion, rebranded in October 2021 after a vulnerability in its legacy file transfer appliance allowed an extortion gang to breach hundreds of organizations. That campaign was part of a broader wave of attacks on file transfer products. Kiteworks declined to identify which federal authorities provided the intelligence or which hacking group prompted the warning. The company said it worked with federal intelligence authorities throughout the weekend and shared threat intelligence with industry partners, including Mandiant.