Saturday, 26 September 2026

Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)

Kiteworks, known as Accellion until a rebrand in late 2021 (TechCrunch, 2026-09-25), sells secure file-transfer and confidential-communication products used by government organizations, financial institutions and enterprises (BleepingComputer, 2026-09-25). On 2026-09-25 it emailed customers worldwide urging a precautionary shutdown of every Kiteworks system, staggered by time zone from AEST to PDT and given in the email as six hours (Heise Online, 2026-09-25). Kiteworks' own press release later gave nine hours (Kiteworks, 2026-09-27). The Central European window fell 04:00–10:00 CEST on Saturday 2026-09-26, a time zone Switzerland shares (Heise Online, 2026-09-25). In the customer email Heise obtained, CISO Frank Balonis wrote that the company "received credible threat intelligence from law enforcement indicating an attack on Kiteworks systems may be imminent this weekend" (Heise Online, 2026-09-25), and recommended shutting systems down even where they are not directly internet-facing, since the possible access route is unconfirmed. Kiteworks' statements to BleepingComputer and The Record and its own later releases instead name "federal intelligence authorities" as the source of the warning, while its statement to TechCrunch again says law enforcement (BleepingComputer, 2026-09-25) (The Record, 2026-09-25) (Kiteworks, 2026-09-27) (TechCrunch, 2026-09-25). Kiteworks states plainly it is "not aware of any compromise of Kiteworks systems" and that "all known vulnerabilities are addressed in our current release, 9.5.1" (BleepingComputer, 2026-09-25); the advisory is preventative, not a confirmed-breach response. Researcher Kevin Beaumont pointed to a listing of at least a thousand internet-facing Kiteworks systems, though TechCrunch notes the count is likely an overcount of actually-affected customer systems (TechCrunch, 2026-09-25), and watchTowr's Jake Knott noted "There is no known CVE, patch, or additional technical details available" while calling the request itself unusual: "nobody requests that their entire customer base unplug production systems over the weekend because of a hunch"; Kiteworks did not answer The Record's question about a CVE (The Record, 2026-09-25).

The precedent class is exactly the one that matters for public-sector defenders: BleepingComputer notes that the Clop extortion gang "has a long history of targeting enterprise platforms in data-theft attacks," naming Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer as past victims of that pattern (BleepingComputer, 2026-09-25); no actor has been named or confirmed for this specific warning by Kiteworks, the FBI, or CISA. Kiteworks itself was formerly Accellion, whose FTA product was the subject of exactly this kind of zero-day mass exploitation in December 2020, when a Clop-linked group stole data from dozens of high-profile organizations (The Record, 2026-09-25).

CVE-2026-65660, Microsoft SharePoint: a SafeControls parser-desync lets an authenticated attacker forge a second Register directive and reach RCE via in-memory XAML deserialization, now confirmed exploited (CVSS 8.8)

CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 2026-09-25 (CISA, 2026-09-25), and its KEV catalog data feed carries the field forensicTriage: Yes for this CVE; CISA's own designation for entries where its Forensics Triage Requirements guidance applies before remediation (CISA Known Exploited Vulnerabilities Catalog, JSON feed, 2026-09-25). The same day, Microsoft revised its own CVE record to state plainly: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability" (Microsoft Security Response Center, 2026-09-25), a reversal of the exploitability assessment Microsoft's own advisory carried "at the time of original publication," "Exploitation Less Likely" (Microsoft Security Response Center, 2026-09-25). Microsoft's own revision log separately records a 27 August 2026 update to the record's Impact, CVE Title and FAQs, described only as "an informational change," with no prior value stated. The bug sits in SharePoint's ToolPane.GetPartPreviewAndPropertiesFromMarkup(), which checks a web part's Register directive against the SafeControls allow-list before parsing it; because RegisterDirective.GetHtml() writes attribute values inside double quotes without escaping embedded quote characters, an attacker can split a directive's Src attribute across the quote boundary to smuggle a second, unchecked Register directive into the markup after the SafeControls check has already run, registering an arbitrary .NET class (Viettel Cyber Security, Dinh Ho Anh Khoa, 2026-09-22). Wrapping System.Xaml.XamlServices in an ExpandedWrapper and invoking XamlServices.Parse() on an ObjectDataProvider gadget then yields what the researcher terms an "in-memory webshell", repeatable code execution held entirely in the worker process's memory, with no file written to disk (Viettel Cyber Security, 2026-09-22). The base bug needs only low-privilege authentication and no user interaction (MSRC FAQ, 2026-09-25), and Viettel's public write-up includes the working exploit markup itself; the same researcher separately showed ToolPane's own authentication check can be bypassed via a distinct, already-patched (9 June 2026) flaw, and Canada's Cyber Centre confirms the pair chains to pre-authentication RCE on SharePoint servers configured for anonymous access (Canadian Centre for Cyber Security, AL26-023, 2026-09-24). Fixed since the 11 August 2026 cumulative update, which also disables the vulnerable function by default; the discloser separately states the underlying bug affects SharePoint 2013 as well, a version Microsoft's own CVE record does not address. Canada's Cyber Centre separately flags that SharePoint Enterprise Server 2016 and Server 2019 themselves reached end of life on 15 July 2026 and urges migration to a supported version (Canadian Centre for Cyber Security, AL26-023, 2026-09-24).

Because no file-based web shell is dropped, file-integrity monitoring of the wwwroot tree will not catch this technique. Canada's Cyber Centre recommends monitoring for unusual SharePoint administrative activity or suspicious authenticated access attempts, watching for Microsoft Defender or AMSI detections tied to SharePoint exploitation activity, and conducting ongoing log and security monitoring of SharePoint, IIS, endpoint security and authentication logs (Canadian Centre for Cyber Security, AL26-023, 2026-09-24).

Triage: ordinary SharePoint web-part usage never registers a second, unchecked control after the SafeControls check has already passed on the same request, a Register directive whose Src attribute value contains an embedded, unescaped quote character is itself the anomaly, distinct from routine web-part edits which SharePoint's own markup generation never produces.

Switzerland's Federal Council orders drafting of a standalone Cybersecurity Act (CSG), relocating the critical-infrastructure incident-reporting duty out of the Information Security Act

Switzerland's Federal Council decided at its session of 2026-09-25 to task the Federal Department of Defence, Civil Protection and Sport (VBS) with drafting, by June 2027, a consultation proposal for a new, standalone federal Cybersecurity Act (Bundesgesetz über die Cybersicherheit, CSG) (Bundesamt für Cybersicherheit, 2026-09-25). The CSG folds together three previously separate parliamentary mandates the Federal Office for Cybersecurity (BACS) had been developing as amendments to the existing Information Security Act (ISG): binding cyber-resilience requirements for manufacturers, importers and retailers of hardware and software products, explicitly modeled on the EU Cyber Resilience Act to ease compliance for internationally active firms already subject to it; strengthened protection duties for particularly important digital data; and participation and defense obligations for hosting and cloud providers (Bundesamt für Cybersicherheit, 2026-09-25).

Most consequential for the constituency this brief serves: the existing mandatory cyber-incident reporting duty for critical-infrastructure operators, in effect under the ISG since April 2025, is being relocated out of the ISG and into the new CSG; the ISG itself will continue to govern only the information security of federal authorities (Bundesamt für Cybersicherheit, 2026-09-25). Sector-specific rules under the Telecommunications Act, the Electricity Supply Ordinance and the Telecommunications Installations Ordinance are left untouched, with the CSG framed as supplementing them with cross-cutting duties. No operational obligation changes today: this is a drafting mandate with a June 2027 consultation-draft deadline, not yet a bill, but it settles the future statutory home of the incident-reporting duty that federal, cantonal and communal critical-infrastructure operators already comply with, and signals that product-cyber-resilience and hosting/cloud-provider obligations comparable to the EU CRA are coming to Switzerland as a dedicated instrument rather than an ISG amendment.