CVE-2025-53899
Accellion Kiteworks Managed File Transfer ≤ 9.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-53899 is a high-severity Incorrectly Specified Destination in a Communication Channel (CWE-941) vulnerability in Accellion Kiteworks Managed File Transfer. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199896
Vulnerability Data
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances…
more
to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement policies can require that outgoing channels only connect to approved, correctly-specified destinations.
Boundary protection at managed interfaces can enforce that communications are directed only to authorized external endpoints.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and change control prevent mis-specified endpoints from being deployed.
Network monitoring can detect traffic to wrong destinations but does not prevent the specification error itself.
Documented network data-flow diagrams directly reduce the chance of specifying an incorrect destination address.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect destinations, yet it is a detection rather than prevention control.
Network security controls enforce correct endpoint validation and routing, directly preventing mis-specified destinations.
Security of network services includes service endpoint verification, mitigating incorrect destination specification.
Network segregation reduces exposure but does not address destination specification within allowed segments.
Secure SDLC practices can catch destination errors during design, but coverage is indirect.
Application security requirements may mandate destination validation, yet the control is high-level.