CVE-2026-112353
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
GFI KerioConnect before 10.0.8 Patch 2 contains a stored XSS vulnerability in the Webmail component. An attacker can upload a crafted SVG email attachment that bypasses event-handler attribute sanitization and executes JavaScript in the victim's authenticated Webmail session. The exploit is actively used to steal credentials and mailbox contents.
Risk Assessment
An attacker could steal the victim's credentials and mailbox contents, leading to further attacks and data leakage. The vulnerability is actively exploited in the wild.
Recommendation
Immediately update KerioConnect to version 10.0.8 Patch 2 or later. Also monitor for suspicious attachments and implement additional email security controls.
Other vulnerabilities in KerioConnect
Original NVD description (English source)
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS