Loading story…
Kiteworks, formerly Accellion, warned customers of a credible and potentially imminent cyberattack targeting its systems and recommended a coordinated six-hour shutdown before the September 26 weekend. The company said the warning was based on law-enforcement intelligence and may involve exploitation of an unknown zero-day vulnerability; it advised shutting down affected systems even if they are not internet-facing because the potential access paths are unknown.
Kiteworks said it had no evidence that customer environments had been compromised when it issued the advisory. It stated that all known vulnerabilities are fixed in version 9.5.1 and urged customers to upgrade, while withholding the suspected attack vector, threat actor, law-enforcement source, and number of organizations potentially at risk.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Kiteworks advised customers to shut down systems, including those not exposed to the internet, for a six-hour worldwide precautionary window while it and law-enforcement partners investigated possible exploitation of an unknown zero-day. For Central Europe, the planned shutdown window was 04:00–10:00 on September 26.
Kiteworks told customers it had received credible threat intelligence from law enforcement that a threat actor might imminently target customer systems. It said the advisory was preventative and that it was not aware of any compromise at the time.
Kiteworks stated that all vulnerabilities known to the company had been fixed in software version 9.5.1 and recommended that customers use that release. The company remained concerned about a potential unknown zero-day vulnerability.
Before its late-2021 rebrand to Kiteworks, Accellion suffered a vulnerability-based mass compromise in which an extortion gang stole data from hundreds of organizations' file-transfer servers and threatened to publish it unless ransoms were paid.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcetechcrunch.com
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
German police contacted and in some cases visited corporate IT administrators at their homes during the early hours of Sunday morning to warn them about a critical, unpatched deserialization vulnerability in **PTC Windchill** and **FlexPLM**. The flaw, tracked as `CVE-2026-4681` and `WID-SEC-2026-0822`, can enable remote code execution and carries a **CVSS v4 score of 9.3** and a **CVSS v3.1 score of 10**. Authorities said they believed criminal actors were likely to exploit the issue imminently to compromise systems, steal data, and deploy ransomware. The warning effort was coordinated by Germany’s **Federal Criminal Police Office** with state police, including Lower Saxony investigators, to quickly notify affected companies and reduce the risk of serious damage. PTC said it had no confirmed evidence of customer exploitation but released indicators of compromise and urgent mitigation guidance for **Apache** and **IIS** deployments, while advising organizations to disconnect internet-exposed systems if workarounds could not be applied quickly.
Jun 29, 2026
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, triggering mandatory remediation timelines for U.S. federal civilian agencies. The newly listed issues include an actively exploited flaw in **SolarWinds Web Help Desk** (`CVE-2025-40536`) with an accelerated patch deadline, alongside additional KEV additions affecting **Apple** platforms (iOS, macOS, tvOS, watchOS, visionOS), **Microsoft** products, and **Notepad++**. Apple stated it was aware of reports the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” with **Google Threat Analysis Group** credited with discovery, underscoring continued targeting of high-value users via mobile/endpoint zero-days. Separate reporting highlighted the broader operational context driving these directives: **Microsoft’s February security update** addressed **59 vulnerabilities**, including **six zero-days under active exploitation**, reinforcing that exploit timelines are compressing and patching is increasingly a “defense sprint.” In parallel, CISA also moved to reduce systemic exposure at the perimeter by ordering agencies to **remove unsupported network edge devices** (e.g., firewalls/routers) within a year, reflecting concern that end-of-support infrastructure and rapidly weaponized vulnerabilities are converging into a persistent, high-impact federal risk.
Jun 29, 2026