Kiteworks says customers may restore normal operations after its precautionary shutdown. Its September 28 statement says hosted systems were back online and monitoring found no indication of compromise. The original advisory now says the shutdown recommendation was lifted on September 27; self-hosted Advanced Forms customers should contact support for assistance. An old shutdown headline is therefore not a current instruction to switch systems off. [1] [3]
What changed during the shutdown
Kiteworks says its work with federal intelligence authorities uncovered a previously unknown critical vulnerability in a capability enabled by less than 1% of customers. The company developed and deployed a fix during the shutdown window and added another protective layer across all environments. That percentage describes use of the capability, not a measured share of compromised customers. Kiteworks reports no indication that the flaw was exploited; this is the vendor’s finding, rather than an independent audit of every installation. [3]
A pause before a confirmed incident
The public notice concerns the September 26–27 weekend. Kiteworks says it sent customers the precise hours directly. It also identifies release 9.5.1 as addressing all known vulnerabilities. The advisory does not identify an attacker, exploit or affected CVE.
These statements answer different questions. Updating addresses the flaws a vendor knows about; a temporary shutdown limits access to a service during a particular threat window. The unusual part is their combination: customers were asked to interrupt an otherwise operating file-exchange service while the threat remains publicly unexplained.
The initial warning did not establish a confirmed zero-day attack. The later restoration statement reports no indication of exploitation, rather than proof that every installation is safe. Nor does a precautionary pause carry the same meaning as the documented Azure resource destruction in the Storm-3168 case, where investigators described actions that had already occurred. Here, the public evidence is a warning and the vendor’s preventive response.
The important split is who runs the system
Self-managed customers—including those running Kiteworks on AWS or Azure—were instructed to handle shutdown themselves. Kiteworks handles its own hosted customer systems. The vendor also excludes its other subsidiaries, including ownCloud and DRACOON, from this warning.
“In the cloud” is not enough to decide who acts. A business can rent cloud infrastructure and still administer the application running on it. The useful question is whether your team operates that Kiteworks installation or Kiteworks operates it for you. A file recipient should take that question to the organization that supplied the transfer link, rather than trying to change a server they do not manage.
Use the restoration notice, not the old shutdown window
The September 28 statement permits customers who have not restarted to bring Kiteworks back online. Kiteworks says it already restored the systems it hosts. If your organization operates its own installation, have its administrator follow the current environment-specific instructions; the original advisory specifically directs self-hosted Advanced Forms customers to support. The public support page provides the customer portal and round-the-clock contact channels. [1] [2] [3]
If a transfer remains unavailable, ask the organization that supplied the link to check that installation. The dated restoration announcement does not independently establish the current availability of every portal. For an urgent transfer, request an approved alternative rather than moving sensitive documents to an improvised personal account.
The practical distinction remains who operates the installation. The precautionary pause has been lifted, while restart assistance and present-day service availability should be checked with the responsible administrator or Kiteworks support.
References
- Kiteworks. “Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence From Federal Intelligence Authorities.” September 25, 2026; shutdown-lifting notice September 27; accessed October 6, 2026. Official advisory.
- Kiteworks. “How Can We Help?” Customer support, accessed September 27, 2026. Official support channels.
- Kiteworks. “Kiteworks’ Difficult and Unique Decision to Ensure Customer Data Protection Through Customer-Wide Shutdown Successfully Navigates Credible Threat.” September 28, 2026; accessed October 6, 2026. Official restoration statement.
