CVE-2025-53899: kiteworks managed — Fix

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.

Is your site exposed to CVE-2025-53899?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-941 CWE-941

Affected Products

Vendor	Product	Versions
accellion	kiteworks_managed_file_transfer	< 9.1.0

References

Advisories & Patches

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5

Frequently Asked Questions

What is CVE-2025-53899? +

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0. It has a CVSS v3.1 base score of 7.2 (HIGH).

How severe is CVE-2025-53899? +

CVE-2025-53899 has a CVSS v3.1 score of 7.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-53899? +

CVE-2025-53899 affects products from accellion, specifically: kiteworks_managed_file_transfer. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-53899? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-34947 9.4

Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack.

CVE-2024-29415 8.1

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, …

CVE-2025-0036 3.2

In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data …

CVE-2026-24751 8.2

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms …

CVE-2026-24752 8.2

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms …

CVE-2026-24782 7.6

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could …

CVE-2025-53899