Live › vulnerability › CVE-2026-112356
Go to dashboardKerio Connect versions before 10.0.9 Patch 2 have a cross-site scripting flaw in Webmail's link auto-formatter, which re-processes text already inside a link. A remote attacker who sends a crafted email can break out of the href attribute and run script in the victim's authenticated Webmail session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Teams running Kerio Connect with Webmail enabled, where users open mail in a browser, are exposed. The attack needs a victim to open the crafted message in Webmail, and the sources do not describe a default-off or special configuration. Installations on a version at or after 10.0.9 Patch 2 are not affected.
No product ranges from the sources yet.
10.0.9 Patch 2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
This page as .md · .json · in your agent: get_signal("CVE-2026-112356")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.