Saturday, 26 September 2026

Kiteworks (formerly Accellion) tells customers worldwide to shut down every server for six hours after 'credible' law-enforcement intelligence of an imminent attack, no CVE assigned

Kiteworks (a secure managed-file-transfer and confidential-communications platform rebranded from Accellion in 2021, marketed to government agencies, financial institutions and enterprises) emailed customers worldwide on 2026-09-25 urging a precautionary six-hour shutdown of every Kiteworks system, staggered by timezone; the Central European window falls 04:00–10:00 CEST on Saturday 2026-09-26, a timezone Switzerland shares (Heise Online, 2026-09-25). CISO Frank Balonis told Heise Online the company "received credible threat intelligence from law enforcement indicating an attack on Kiteworks systems may be imminent this weekend" (Heise Online, 2026-09-25), and recommended shutting systems down even where they are not directly internet-facing, since the possible access route is unconfirmed. No CVE has been assigned, and Kiteworks states plainly it is "not aware of any compromise of Kiteworks systems" and that "all known vulnerabilities are addressed in our current release, 9.5.1" (BleepingComputer, 2026-09-25); the advisory is preventative, not a confirmed-breach response. Researcher Kevin Beaumont's Shodan search found roughly a thousand internet-facing Kiteworks instances, though TechCrunch notes the count is likely an overcount of actually-affected customer systems (TechCrunch, 2026-09-25), and watchTowr's Jake Knott called the request itself unusual: "nobody requests that their entire customer base unplug production systems over the weekend because of a hunch" (The Record, 2026-09-25).

The precedent class is exactly the one that matters for public-sector defenders: BleepingComputer notes that the Clop extortion gang "has a long history of targeting enterprise platforms in data-theft attacks," naming Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer as past victims of that pattern (BleepingComputer, 2026-09-25); no actor has been named or confirmed for this specific warning by Kiteworks, the FBI, or CISA. Kiteworks itself was formerly Accellion, whose FTA product was the subject of exactly this kind of zero-day mass exploitation in December 2020, when a Clop-linked group stole data from dozens of high-profile organizations (The Record, 2026-09-25).

CVE-2026-65660, Microsoft SharePoint: a SafeControls parser-desync lets an authenticated attacker forge a second Register directive and reach RCE via in-memory XAML deserialization, now confirmed exploited (CVSS 8.8)

CISA added CVE-2026-65660 to its Known Exploited Vulnerabilities catalog on 2026-09-25 (CISA, 2026-09-25), and its KEV catalog data feed carries the field forensicTriage: Yes for this CVE; CISA's own designation for entries where its Forensics Triage Requirements guidance applies before remediation (CISA Known Exploited Vulnerabilities Catalog, JSON feed, 2026-09-25). The same day, Microsoft revised its own CVE record to state plainly: "As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability" (Microsoft Security Response Center, 2026-09-25), a reversal of the exploitability assessment Microsoft's own advisory carried "at the time of original publication," "Exploitation Less Likely" (Microsoft Security Response Center, 2026-09-25). Microsoft's own revision log separately records a 27 August 2026 update to the record's Impact, CVE Title and FAQs, described only as "an informational change," with no prior value stated. The bug sits in SharePoint's ToolPane.GetPartPreviewAndPropertiesFromMarkup(), which checks a web part's Register directive against the SafeControls allow-list before parsing it; because RegisterDirective.GetHtml() writes attribute values inside double quotes without escaping embedded quote characters, an attacker can split a directive's Src attribute across the quote boundary to smuggle a second, unchecked Register directive into the markup after the SafeControls check has already run, registering an arbitrary .NET class (Viettel Cyber Security, Dinh Ho Anh Khoa, 2026-09-22). Wrapping System.Xaml.XamlServices in an ExpandedWrapper and invoking XamlServices.Parse() on an ObjectDataProvider gadget then yields what the researcher terms an "in-memory webshell", repeatable code execution held entirely in the worker process's memory, with no file written to disk (Viettel Cyber Security, 2026-09-22). The base bug needs only low-privilege authentication and no user interaction (MSRC FAQ, 2026-09-25), and Viettel's public write-up includes the working exploit markup itself; the same researcher separately showed ToolPane's own authentication check can be bypassed via a distinct, already-patched (9 June 2026) flaw, and Canada's Cyber Centre confirms the pair chains to pre-authentication RCE on SharePoint servers configured for anonymous access (Canadian Centre for Cyber Security, AL26-023, 2026-09-24). Fixed since the 11 August 2026 cumulative update, which also disables the vulnerable function by default; the discloser separately states the underlying bug affects SharePoint 2013 as well, a version Microsoft's own CVE record does not address. Canada's Cyber Centre separately flags that SharePoint Enterprise Server 2016 and Server 2019 themselves reached end of life on 15 July 2026 and urges migration to a supported version (Canadian Centre for Cyber Security, AL26-023, 2026-09-24).

Because no file-based web shell is dropped, file-integrity monitoring of the wwwroot tree will not catch this technique. Canada's Cyber Centre recommends monitoring for unusual SharePoint administrative activity or suspicious authenticated access attempts, watching for Microsoft Defender or AMSI detections tied to SharePoint exploitation activity, and conducting ongoing log and security monitoring of SharePoint, IIS, endpoint security and authentication logs (Canadian Centre for Cyber Security, AL26-023, 2026-09-24).

Triage: ordinary SharePoint web-part usage never registers a second, unchecked control after the SafeControls check has already passed on the same request, a Register directive whose Src attribute value contains an embedded, unescaped quote character is itself the anomaly, distinct from routine web-part edits which SharePoint's own markup generation never produces.

Switzerland's Federal Council orders drafting of a standalone Cybersecurity Act (CSG), relocating the critical-infrastructure incident-reporting duty out of the Information Security Act

Switzerland's Federal Council decided at its session of 2026-09-25 to task the Federal Department of Defence, Civil Protection and Sport (VBS) with drafting, by June 2027, a consultation proposal for a new, standalone federal Cybersecurity Act (Bundesgesetz über die Cybersicherheit, CSG) (Bundesamt für Cybersicherheit, 2026-09-25). The CSG folds together three previously separate parliamentary mandates the Federal Office for Cybersecurity (BACS) had been developing as amendments to the existing Information Security Act (ISG): binding cyber-resilience requirements for manufacturers, importers and retailers of hardware and software products, explicitly modeled on the EU Cyber Resilience Act to ease compliance for internationally active firms already subject to it; strengthened protection duties for particularly important digital data; and participation and defense obligations for hosting and cloud providers (Bundesamt für Cybersicherheit, 2026-09-25).

Most consequential for the constituency this brief serves: the existing mandatory cyber-incident reporting duty for critical-infrastructure operators, in effect under the ISG since April 2025, is being relocated out of the ISG and into the new CSG; the ISG itself will continue to govern only the information security of federal authorities (Bundesamt für Cybersicherheit, 2026-09-25). Sector-specific rules under the Telecommunications Act, the Electricity Supply Ordinance and the Telecommunications Installations Ordinance are left untouched, with the CSG framed as supplementing them with cross-cutting duties. No operational obligation changes today: this is a drafting mandate with a June 2027 consultation-draft deadline, not yet a bill, but it settles the future statutory home of the incident-reporting duty that federal, cantonal and communal critical-infrastructure operators already comply with, and signals that product-cyber-resilience and hosting/cloud-provider obligations comparable to the EU CRA are coming to Switzerland as a dedicated instrument rather than an ISG amendment.