The flaw was previously unknown and is described as being confined to a capability that is enabled for less than 1% of the customer base. The discovery came about during the shutdown window, which Kiteworks had initiated as a precautionary measure.

Key points:

• The vulnerability is rated critical.
• It affects a capability enabled for less than 1% of customers.
• The issue was previously unknown prior to the shutdown.
• Kiteworks coordinated with federal intelligence authorities during the identification and remediation process.
• The company has since addressed the flaw.

No specific CVE identifier, advisory number, or affected version list was provided in the available reporting.

Organizations running Kiteworks should confirm with the vendor whether the affected capability is enabled in their environment, and apply any guidance issued as part of the fix.

Source: The Hacker News

Does your organization use Kiteworks, and if so, have you verified whether the impacted capability is enabled in your deployment?