Cybersecurity
Kiteworks patches flaw after precautionary shutdown
Kiteworks said it patched a critical vulnerability during a planned shutdown after receiving threat intelligence, then lifted advice for customers to keep systems offline once no anomalies were seen.
- Kiteworks said it found and fixed a critical vulnerability during the weekend shutdown.
- It said federal intelligence authorities were involved, and that there was no evidence the flaw had been used maliciously.
- The company said the flaw affected a capability enabled for fewer than 1% of customers, and other products were not affected.
- Kiteworks had earlier told customers to take systems offline for nine hours after receiving intelligence about a possible imminent attack, and it lifted that advice on 27 September 2026.
- Kiteworks had not disclosed how the flaw worked or given it a CVE number as of publication.
Kiteworks said on Monday that it identified a critical vulnerability during the weekend shutdown and fixed it while the shutdown was under way. The company said it had worked with federal intelligence authorities and had added another protective layer across its environments.
The company said the flaw was limited to a capability used by fewer than 1% of customers. It also said there was no evidence of malicious exploitation, and that its other products were not affected.
Days earlier, Kiteworks had told customers to take their systems offline for nine hours and had also shut down environments it hosts for customers. It said that step followed intelligence about a possible attack and was intended as a precaution rather than a response to a confirmed breach.
Kiteworks lifted the shutdown recommendation on 27 September 2026 after saying no anomalies had been observed. It had not disclosed technical details of the flaw or assigned it a CVE identifier.
Kiteworks CISO Frank Balonis said the company had not taken the decision lightly. He said the company chose to protect customer data rather than keep services online.
Named in this story
People
- Frank Balonis
- Kiteworks CISO who defended the shutdown decision
Companies
- Kiteworks
- said it found and fixed the flaw and advised customers to take systems offline
Governments and agencies
- federal intelligence authorities
- worked with Kiteworks over the weekend
How the source tells it
The article is mostly factual, but it carries a restrained sense of urgency and reassurance through the company’s own explanation for the shutdown and fix.
- urgency the warning about a possible imminent attack and the offline order created time pressure
- reassurance repeated notes that there was no evidence of malicious use or any anomalies
- vendor self-justification the company’s quoted defence of the outage presented the choice as a deliberate trade-off