CVE-2026-112356
GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
GFI USA, LLC GFI KerioConnect
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 10.0.9p2GFI KerioConnectCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
Text from CVE List
Affected versions 1
- GFI KerioConnectaffected: all versions before 10.0.9p2CVE List