Cybersecurity Research

Kiteworks Customers Told to Shut Down Servers Over Possible Imminent Attack

Sophos · 25 Sept 2026

Key Takeaway If your business uses Kiteworks, check for the vendor's email now and follow its shutdown guidance or contact Kiteworks directly to confirm next steps.

On September 25, 2026, reports emerged that Kiteworks (formerly Acellion) had emailed customers with a warning. According to those reports, law enforcement alerted the company to an "imminent" cyberattack on Kiteworks systems. The attack may involve exploitation of a zero-day vulnerability, which is a software flaw that attackers can use before a fix is available.

Kiteworks reportedly advised customers to shut down their servers between 02:00 and 08:00 UTC on September 26, or sooner if possible. The company described the step as a "precautionary" measure. The reports do not confirm that an attack has taken place, and the source article does not provide further technical detail about the suspected threat.

Researchers from the Sophos Counter Threat Unit recommend that Kiteworks customers follow the guidance in the vendor's email or contact Kiteworks directly. Australian businesses that use Kiteworks should check whether they have received the notice, confirm the timing against their local time zone, and speak to their IT provider or the vendor about the safest way to proceed.

Kiteworks zero-day vendor advisory file transfer security

Summarised by CISO AI from Sophos, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.