Kiteworks, a vendor of secure content-sharing infrastructure, has issued patches for 126 security flaws discovered across its product line. Among them is a maximum-severity vulnerability in the Email Protection Gateway (EPG), a key module within the Kiteworks Private Content Network (PCN) platform.
The PCN integrates email security, Managed File Transfer (MFT), file sharing, APIs, and web forms into a unified system. Kiteworks, which operates under a name change from its former identity as Accellion, serves thousands of enterprises and government bodies globally, with the PCN reaching more than 100 million end-users.
In the same patch cycle, the company remediated 11 critical flaws spanning authentication bypass, admin account takeover, stored cross-site scripting (XSS), access control failures, and authentication weaknesses affecting both the Core and EPG components.
Critical flaw details
The maximum-severity issue, identified as CVE-2026-54154, was disclosed through Kiteworks' bug bounty partnership with YesWeHack. The vulnerability permits unauthenticated remote attackers to execute arbitrary code and seize control of affected EPG appliances by chaining path traversal, code injection, and missing authentication checks in attacks of low complexity that need no user action.
All Kiteworks Email Protection Gateway versions prior to 9.4.1 remain vulnerable. The patch is available in version 9.4.1 and subsequent releases.
A combination of input-handling flaws in publicly reachable endpoints of the Kiteworks Email Protection Gateway potentially allowed an unauthenticated remote attacker to achieve arbitrary code execution and, by chaining additional local weaknesses, to escalate to full administrative (root) control of the appliance
Kiteworks, in a Wednesday advisory
Recent threat activity and response
Last week, Kiteworks instructed customers to take their systems offline following threat intelligence indicating a potential imminent zero-day attack. The company rescinded this precautionary notice on Monday after deploying a critical patch and restoring all hosted customer infrastructure to operation. According to Kiteworks, no evidence of compromise or malicious activity was discovered during the incident.
The vendor has not yet released further specifics regarding the vulnerability that prompted the shutdown order and has not assigned a CVE identifier for that particular flaw, complicating tracking efforts.
Security monitoring firm Shadowserver has identified approximately 400 Kiteworks instances accessible from the public internet. The firm has not disclosed how many of these systems have received patches or whether any are honeypots deployed for research purposes.