CVE-2025-53896: Accellion Kiteworks Managed File Transfer

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.

Affected products

• Accellion Kiteworks Managed File Transfer: before 9.1.0 (fixed in 9.1.0)

Published 2025-11-29. Last modified 2026-10-07.