Kerio Connect Vulnerability CVE-2026-112353 Exploited in the Wild to Steal Mailboxes
Do Son 
TL;DR
Attackers have exploited CVE-2026-112353, a stored XSS flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. According to the CVE record published by VulnCheck, “Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.” This Kerio Connect vulnerability scores 8.2 on CVSS v3.1 and 6.2 on CVSS v4.
A crafted SVG email attachment can run JavaScript in a victim’s Webmail session. GFI fixed the bug in KerioConnect 10.0.8 Patch 2 back in November 2025. Unpatched servers face active attacks, so update now.
- CVE: CVE-2026-112353
- CVSS: 8.2 (High · CVSSv3)
- Product: GFI USA, LLC GFI KerioConnect
- Affected: < 10.0.8p2
- Impact: GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
- Status: Exploited in the wild
- Patched in: 10.0.8p2
- EPSS: 0.2% (30-day)
- Action: Update to 10.0.8p2 now
Why It Matters
Email servers hold credentials, contacts and sensitive messages. As a result, a single malicious attachment can hand attackers a victim’s whole mailbox. Moreover, attackers need no account on the server, since the payload arrives by email.
How the Attack Works
The stored XSS flaw sits in the Webmail component. VulnCheck’s advisory explains that a crafted SVG attachment “bypasses sanitization of event-handler attributes.” In addition, the temporary-download endpoint applies an “insufficient Content-Security-Policy sandbox.” When the victim opens the attachment, the script runs inside their logged-in session.
Affected Versions
All GFI KerioConnect versions before 10.0.8 Patch 2 are affected by this Kerio Connect vulnerability. Proofpoint researchers Stu Del Caliz and Greg Lesnewich are credited with finding it.
Patch and Mitigation
GFI’s KerioConnect release notes list the fix in version 10.0.8p2, released November 28, 2025. The update “closed a Webmail cross-site scripting (XSS) vulnerability.” GFI adds that “Script execution is now disabled for downloaded content.”
Admins should install the update and warn users about unexpected SVG attachments. Also, review Webmail sessions for signs of credential theft. The Kerio Connect vulnerability is not yet in CISA’s KEV catalog.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
