Live › vulnerability › CVE-2026-112353
Go to dashboardKerio Connect before 10.0.8 Patch 2 lets a remote attacker upload an SVG email attachment with event-handler code that bypasses sanitization. When a victim opens the attachment, the script runs in their authenticated Webmail session and can steal credentials and mailbox contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Organizations running Kerio Connect Webmail before 10.0.8 Patch 2 are exposed, because any user who opens a crafted SVG attachment can have their session abused. Teams on newer patched releases or not running Kerio Connect can skip it.
No product ranges from the sources yet.
10.0.8 Patch 2 are affected10.0.8 Patch 2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
This page as .md · .json · in your agent: get_signal("CVE-2026-112353")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.