Act nowDisclosed

Advisory · CVE-2026-112353

Stored XSS in GFI KerioConnect webmail, observed stealing credentials in the wild

GFI KerioConnect before 10.0.8 Patch 2 contains a stored cross-site scripting flaw in Webmail: a crafted SVG email attachment bypasses sanitization of event-handler attributes and runs in a victim's authenticated session when opened, enabling theft of credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild. CVSS 3.1 8.2.

Advisory published October 27, 2026Independent summary
Vendor
GFI
Product
KerioConnect
Identifier / CWE
CVE-2026-112353
CWE-79, CWE-83
Action timing
Immediate
ELI5

Explain it like I’m five

An email attachment that is really a script in an SVG costume sails through the webmail's cleaning, and when the victim opens it, the script runs as them inside their mailbox, reading mail and stealing the keys to the account.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted email sent

    The attacker emails a crafted SVG attachment that carries event-handler attributes the sanitizer misses.

  2. 02Victim opens the attachment

    The victim opens the attachment in KerioConnect Webmail on a server before 10.0.8 Patch 2.

  3. 03Script runs in session

    The temporary-download endpoint's insufficient Content-Security-Policy sandbox lets the script execute in the victim's authenticated Webmail session.

  4. 04Credentials and mail stolen

    Per the record, the script can steal the victim's credentials and mailbox contents; Proofpoint observed this running as a credential and mailbox stealer in the wild.

What happened

CVE-2026-112353 was published in NVD on October 27, 2026, rated high at CVSS 3.1 8.2: GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability (CWE-79, CWE-83) in the Webmail component that allows a remote attacker to run JavaScript in a victim’s authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. The record states the temporary-download endpoint’s insufficient Content-Security-Policy sandbox allows the script to execute when the attachment is opened, enabling theft of the victim’s credentials and mailbox contents.

The record further states that Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer. The vendor’s release line for this fix is 10.0.8 Patch 2, listed as the first unaffected version in the record.

What to do

  1. Inventory KerioConnect servers and note versions; treat every server before 10.0.8 Patch 2 as exposed.
  2. Update KerioConnect to 10.0.8 Patch 2 or later immediately.
  3. Until updated, consider blocking SVG attachments at the mail gateway and warn users not to open unexpected SVG files in Webmail.
  4. Hunt for the observed pattern: review Webmail and mail logs for SVG attachments followed by unusual session activity, mailbox rule changes, or bulk reading and forwarding.
  5. Force password resets and session revocation for users who opened suspicious attachments, and rotate credentials for any account showing stealer indicators.
  6. Verify the deployed version after updating.

Management note

This one is not theoretical: a named research team watched it steal mailboxes. Mail servers hold the reset keys for everything else in the business, so patch KerioConnect first and run the credential hunt the same day.