What happened: On Friday September 25, 2026, the file-transfer vendor Kiteworks emailed its customers and urged them to shut their systems down over the weekend. No confirmed breach. No named CVE at the time. The company said it had credible intelligence that a threat actor "may attempt to target some Kiteworks systems," and recommended going dark while it worked the matter through with federal authorities.
Updated October 23, 2026: the window passed without a reported compromise. Kiteworks' updated advisory says "As of September 27th, the shutdown recommendation is now lifted for all customers," and that customers with self-hosted Advanced Forms "should contact Customer Support for assistance." Kiteworks' September 28 release says work during the shutdown "led to the discovery of a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the customer base," that it "developed and deployed a fix during the window," and that it "has no indication the vulnerability was ever exploited." On September 30, CVE records for two Advanced Forms flaws followed, CVE-2026-102150 and CVE-2026-102121, both listing 9.5.1 as unaffected; neither says whether it is the flaw found that weekend. Running Advanced Forms yourself? Confirm 9.5.1 or later and call Kiteworks support.
No Kiteworks? You still run something that could produce the same email: the ERP, the EDI translator, the customer portal, the firewall, your machine builder's remote-access tool.
Had that message reached your building on a Friday evening, who would have seen it, and would they have had authority to act? If nobody has been named, the system stays up by default, and that is a decision made by nobody.
What exactly were customers asked to do?
Kiteworks' public advisory describes a nine-hour window "this weekend, in their local time zone," and says the specific hours went out only by email. That email, obtained by Heise and reported by The Record and BleepingComputer, set a six-hour window on Saturday September 26: 4am to 10am Central Europe, 10pm Friday to 4am Saturday in New York.
In Eastern time, the window started at 10pm on a Friday.
The advisory told customers self-managing on premises or on AWS or Azure to shut down themselves; those on Kiteworks-hosted systems needed to do nothing, because Kiteworks said it would power those down in the same window.
As of September 25, no specific vulnerability had been identified or disclosed. TechCrunch reported on September 25 that the company would not say which agency warned it or who the actor was, describing the concern as possible exploitation of flaws not yet known to Kiteworks. The vendor's own wording moved: the press release and CISO Frank Balonis's statement to The Record credit "federal intelligence authorities," while Balonis told TechCrunch, and wrote in the customer email Heise reported, that it came from law enforcement. Kiteworks said all known vulnerabilities were addressed in release 9.5.1, so a customer on an older build did have patching to do. What did not exist on September 25 was a known fix for the thing being warned about.
The threat class was described: possible zero-day exploitation, as soon as that weekend.
Does your incident response plan cover this?
Nothing had been detected on your side. NIST's current guidance, SP 800-61 Revision 3, rebuilt the old lifecycle as a Cybersecurity Framework 2.0 profile, and NIST is explicit that "the six Functions ... all play vital roles in incident response", Govern, Identify and Protect included. So a plan built to that profile can cover this: assessing threat intelligence, naming who escalates, deciding on precautionary containment. The question is whether your plan does. A plan that only covers detect, respond and recover starts after something has been seen, and nothing had been: no alert, no ransom note, just a vendor email on a Friday night.
Our judgement: this looks like a security problem and is really an authority problem, and here we push back on our own industry. Managed detection, a security operations centre, an endpoint agent: every one is built to spot something happening, and nothing was happening yet. If your provider sold you monitoring as the answer to "what if something bad might be coming," it is fair to ask what does reach this.
Who in your building can authorize a shutdown?
Work out the real answer, not the org-chart answer: who reads a distribution list at 6pm on a Friday, and what happens if somebody escalates by phone. If it is a shift lead, is that documented authority or an accident of who was there? Undocumented, somebody is being asked to stop EDI to your largest customer on no standing at all. Same problem in Greensboro, Statesville or Winston-Salem, worse the more sites you run.
Grade yourself against this. Where the right-hand column describes you, that row is a gap to close:
| Question | A good answer | The gap |
|---|---|---|
| Who reads the vendor's notice after 5pm? | A named person and a backup, on an address somebody watches | A distribution list nobody has checked |
| Who can authorize a production-affecting outage, and how fast? | One named approver, an alternate, a stated ceiling like 60 minutes | A conversation that has never had to happen in an hour |
| Who tells customers their files are not moving? | A named owner with two sentences already drafted | Nobody named; nothing alerts when an ASN fails to transmit |
| What is an overnight outage on this system worth? | A number somebody has worked out | No number, because it has never come up |
| Who decides to bring it back up, and against what? | The same named person, against stated conditions | Whoever is there |
Test that third row: if nothing flags a missing document, the outage reaches you later as a delivery-performance ding with a corrective action attached.
If you want this written down before you need it: we do it with you rather than hand you a template; the answers have to be yours. Preferred Data Corporation has served manufacturers, distributors and contractors from High Point since 1987. Call (336) 886-3282.
What is an overnight shutdown worth in your plant?
Possibly less than it feels. With nothing scheduled over the weekend, a Saturday window on a back-office system may cost very little. If EDI or overnight processing runs while the plant is dark, it does not.
Do the arithmetic once, with your controller: shifts affected at loaded hourly cost, whether orders can be taken another way, expedite freight, catch-up overtime, and any scorecard or chargeback exposure. Then somebody can say yes quickly instead of relitigating cost while the clock runs.
Is complying always the right answer?
No. There is a real argument against it: Kiteworks did not say what the intelligence was, which agency supplied it, or what the actor was expected to do, so a customer absorbed a quantifiable cost against a risk it could not evaluate. If this becomes monthly across the industry, "shut it down" stops being usable advice. This time the precaution paid off, by the vendor's own account: a critical flaw found and fixed, no compromise indicated. That is one outcome, not a rule.
Three things would push us toward complying, and the vendor's tone is not one:
- The window is bounded and stated. Six hours in the customer email (nine in the public advisory), with an end time, is a different proposition from "stop using it until further notice," because a bounded window can be scheduled against your shift pattern, the biggest variable in what it costs you.
- The vendor is doing the same thing to the systems it runs. Kiteworks said it would shut down the customer systems it hosts in the same window. A vendor that exempts what it operates while asking you to go dark is telling you something.
- The system faces the internet and holds something worth taking. File-transfer platforms are chosen for exactly that duty, which is also why they have been hit repeatedly. The joint FBI and CISA advisory AA23-158A on the CL0P gang lays out the sequence: zero-day campaigns against Accellion File Transfer Appliance devices in 2020 and 2021, which it attributes to TA505 and equates with CL0P, then Fortra GoAnywhere in early 2023, then MOVEit Transfer. Be precise about the first one: it hit Accellion's legacy FTA product, not the Kiteworks platform. Accellion announced end of life for legacy FTA effective April 30, 2021 and changed its brand name to Kiteworks that October. Same company, product gone. For a defense supplier moving controlled unclassified information along that path there may be a compliance dimension too.
What we would not do is treat compliance as automatic. The rule exists so somebody can run the inputs fast.
Can you say how long it takes to come back up?
Coming back is where we look first. Four causes to check:
- A service set to manual start that somebody started by hand after a maintenance window years ago, and that nobody has restarted since.
- A licence or certificate that validates on startup and has quietly expired.
- A dependency order nobody wrote down: the application comes up before the database is ready, fails, and sits there until somebody notices.
- A password for a local service account that lives in one person's head, and that person is on a boat.
Nobody can say in advance how long: a manual service is minutes once found; an expired licence on a Sunday is however long the vendor takes to answer. Without a clean shutdown and restart in a window you chose, you do not have a restart time. You have a guess, and the guess is what gets quoted to a customer on a Saturday.
If nobody has timed a clean stop and start on your critical systems, that is the work to buy first. Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265, (336) 886-3282, on site within 200 miles.
Write the rule this week
One page, no committee.
- Find out who the decision-maker already is, then write that down. If you hold that authority, name yourself with a mobile number and the systems it covers, then name an alternate, checking one thing first: can you actually delegate, or do you only hold the approval yourself? An IT director or operations manager may have the first without the second. If you cannot delegate, have whoever can put the alternate in writing, or name them as the person who escalates to you rather than a second approver. If you do not hold the authority, do not draft the page at all. Ask whoever does what they want done when a vendor says on a Friday night that this system has to come down. Write it down, read it back, send it to them. That is the page, and it is theirs.
- Pick the default in advance, then make it executable, verified and reversible. "If neither can be reached within 60 minutes, the default is stay up, or come down, and the on-call supervisor keeps calling and logs the time." Choose, then check three things. Executable: stay up needs nobody; come down needs a named person in the same document who may shut down with no approver on the phone, and who knows it and knows how. Verified: nobody acts on the email itself. Whoever executes confirms it on a channel they open themselves: the status page, a support number written down beforehand, or the vendor account reached by typing the address rather than following a link. An instruction to power down is cheap to forge. Decide now which way the 60 minutes resolves when nothing confirms it, because the detail may never reach a public page, as it did not here; leave that blank and the clock runs out with nobody deciding. Reversible: name who restores service and on what signal, or your own rule keeps you dark after the risk has passed. If you will not pre-authorise anybody, stay up is your real default.
- Draft the two sentences you would send customers. Now, in calm conditions, with a blank for the system name and the window.
- Book the restart test. One clean stop and start per system on the list, timed, at a moment you choose. This is the only item that costs money, and money is not why it does not happen: whoever proposes the test owns it if the system does not come back. Name that out loud when you ask. You are choosing to find out on a Saturday you picked, with help on site, rather than on a Saturday somebody else picked.
Hand the page to somebody who was not in the room. If they cannot say who to call within ten seconds, it is not finished.
Frequently Asked Questions
We do not use Kiteworks. Does this apply to us?
The vendor is incidental. Ask which of your systems could produce the same email: the file-transfer or customer portal, the ERP, the VPN or firewall, the remote-access tool your machine builder uses.
Is this the same as a vendor telling us to patch urgently?
No. A patch is a known cost against a described threat and needs a maintenance window. This asked for an outage against an unattributed threat, which needs a business decision: who decides, and how fast.
We are a defense supplier. Does this change anything?
It raises the stakes on the file-transfer path, since that is one route controlled unclassified information travels. The decision structure is the same, but the written rule is worth more, because you may have to evidence what you did and when.
Our IT is outsourced. Is this their decision?
No. A provider can advise, execute the shutdown and give you a restart time. Choosing to stop sending documents to your largest customer overnight belongs to the business, and a provider who says otherwise is accepting authority they cannot carry.
What if the vendor never explains what the threat was?
Raise it at renewal, in writing. As of September 26, The Hacker News noted the company had not disclosed the agency or the actor. Whether a vendor tells you afterwards what it was protecting you from is a reasonable input into whether you comply next time.
Monday morning, one task: ask whoever owns the company what they want done if that email arrives on a Friday night, and write down the answer.
If you would rather not have that conversation cold, we will sit in on it. Preferred Data Corporation is headquartered in High Point, NC, on site within 200 miles and remote across the US and worldwide. (336) 886-3282.
Related Resources
- When a file-transfer platform is the thing under attack, the vulnerability version of the same exposure
- A vendor shutting a service down on its own schedule
- Third-party vendor risk management for NC manufacturers
- An incident response plan template for a small business
- Managed IT, backup and disaster recovery and cybersecurity from Preferred Data Corporation
- IT for North Carolina manufacturers and for logistics and distribution