Kiteworks Email Protection Gateway, authentication bypass (CVSS 9.4), fixed in 9.5.1

Kiteworks' own press release states the recommended shutdown window was nine hours, while press coverage of the initial advisory reported six; the vendor's own page is the more authoritative figure, and neither the press coverage nor Kiteworks' later statement explains the difference. Kiteworks updated its own press release on 2026-09-27 to state the shutdown recommendation is lifted: "As of September 27th, the shutdown recommendation is now lifted for all customers. If you have not already restarted, you may bring your Kiteworks system back online" (Kiteworks, 2026-09-27). CISO Frank Balonis reiterated the company found no evidence of compromise: "We have no indication that Kiteworks or our customers' systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach" (Kiteworks, 2026-09-27). Germany's BSI published advisory WID-SEC-2026-3602 on 2026-09-27, citing the Kiteworks press release as its source and naming the vulnerable component for the first time: "An attacker can exploit a vulnerability in Kiteworks Advanced Forms to carry out an unspecified attack" (translated from German) (BSI CERT-Bund, 2026-09-27), listing Advanced Forms versions below 9.5.1 as affected and fixed in 9.5.1; NCSC Switzerland's Cyber Security Hub advisory was updated the same day with the lifted-shutdown status. No CVE has been assigned to date, and the BSI record carries no vulnerability-class (CWE) description beyond "unspecified attack": genuinely thin technical detail from the vendor side even now.

Kiteworks's own release, dated 2026-09-28, reports the outcome of the shutdown: the threat window "passed without incident", and the company has no indication that any Kiteworks or customer system was compromised (Kiteworks, 2026-09-28). It adds that its engineering and security activity during the shutdown led to the discovery of "a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the customer base", that Kiteworks developed and deployed a fix during the window and applied an additional protective layer across all environments, and that it has no indication the vulnerability was ever exploited; all other Kiteworks products were unaffected (Kiteworks, 2026-09-28). The release names no component and no CVE; whether it is the Advanced Forms flaw that BSI listed on 2026-09-27 is not stated. The vendor's own statements are the only source for the discovery, the fix and the absence of exploitation, and customers with questions are pointed to Kiteworks Technical Support (Kiteworks, 2026-09-28).

On 2026-09-30 Kiteworks published GitHub security advisories for Email Protection Gateway, Core and Secure Data Forms. The most severe, CVE-2026-54154, affects all Email Protection Gateway versions before 9.4.1: a remote attacker may be able to execute arbitrary code with root privileges, with a CVSS 3.1 vector of network, low complexity, no privileges and no user interaction, and Kiteworks credits three researchers who reported it through its YesWeHack bug-bounty programme (Kiteworks, 2026-09-30). BleepingComputer, quoting the advisory, describes input-handling flaws in publicly reachable endpoints that potentially allowed unauthenticated code execution and, by chaining local weaknesses, escalation to root, and lists path traversal, code injection and missing authentication as the chain (BleepingComputer, 2026-10-01). Three further advisories rated CVSS 9.8 describe network-reachable account takeovers that need no privileges or user interaction and are fixed in 9.5.0: two in Email Protection Gateway, CVE-2026-85065 (Kiteworks, 2026-09-30) and CVE-2026-85066 (Kiteworks, 2026-09-30), and one in Core, CVE-2026-102115 (Kiteworks, 2026-09-30). BleepingComputer counts 11 critical fixes in Core and Email Protection Gateway beyond the root chain (BleepingComputer, 2026-10-01). Further fixes in 9.5.1 include an Email Protection Gateway account takeover, CVE-2026-102149, reachable over the network without authentication (Kiteworks, 2026-09-30); a Core account takeover to administrative access through an injection flaw, CVE-2026-102147, that needs user interaction (Kiteworks, 2026-09-30); a Core command execution flaw for administrators, CVE-2026-102142 (Kiteworks, 2026-09-30); and a Secure Data Forms security bypass, CVE-2026-102150, in versions 9.3.0 up to before 9.5.1 (Kiteworks, 2026-09-30).

BleepingComputer reports Kiteworks fixed 126 vulnerabilities in the same cycle and that Shadowserver tracks nearly 400 internet-exposed Kiteworks instances, with no patch-state information (BleepingComputer, 2026-10-01). No advisory states exploitation, and no source ties any of these flaws to the one Kiteworks found during the shutdown, which BleepingComputer says Kiteworks still has not detailed or assigned a CVE (BleepingComputer, 2026-10-01).