Exploited vulnerability

CVE-2026-112353

TLP:CLEAR

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.

Facts

Vendor: GFI USA, LLC
Product: GFI KerioConnect
EPSS (probability of exploitation within 30 days): 0.2 %
First known exploitation: 27 October 2026
First seen by Risk Letters: 27 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD