Loading story…
Kiteworks released security updates addressing 126 vulnerabilities across Kiteworks Core, Email Protection Gateway (EPG), and Secure Data Forms (SDF). The most serious flaws affect Core and EPG versions earlier than 9.5.1, including critical account-takeover vulnerabilities that could expose sensitive files, email workflows, sharing functions, and administrative capabilities. Core fixes also include arbitrary code execution, privilege escalation, and exposure of internal network resources; EPG and SDF fixes address unauthorized data modification, denial of service, and security-bypass issues.
The Canadian Centre for Cyber Security issued advisory AV26-988 urging organizations to review Kiteworks advisories and apply available updates. Administrators should upgrade affected deployments to 9.5.1 or later where applicable, identify internet-facing instances, and investigate suspicious account activity or indications of unauthorized access, particularly before remediation changes alter available evidence.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-988, directing administrators to consult Kiteworks security advisories and apply available updates.
Kiteworks Core, Email Protection Gateway, and Secure Data Forms were identified as affected by unspecified vulnerabilities. Affected releases include versions before 9.5.0 and/or 9.5.1, depending on the product.
Kiteworks released a broad security update for 126 vulnerabilities across its secure data-transfer platform and associated applications. The fixes include critical account-takeover flaws in Core and Email Protection Gateway, arbitrary code execution and privilege escalation in Core, and data-modification, denial-of-service, and security-bypass issues in Email Protection Gateway and Secure Data Forms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecryptika.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
Kiteworks, formerly Accellion, warned customers of a credible and potentially imminent cyberattack targeting its systems and recommended a coordinated six-hour shutdown before the September 26 weekend. The company said the warning was based on law-enforcement intelligence and may involve exploitation of an unknown zero-day vulnerability; it advised shutting down affected systems even if they are not internet-facing because the potential access paths are unknown. Kiteworks said it had no evidence that customer environments had been compromised when it issued the advisory. It stated that all known vulnerabilities are fixed in version `9.5.1` and urged customers to upgrade, while withholding the suspected attack vector, threat actor, law-enforcement source, and number of organizations potentially at risk.
Oct 1, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026