{"id":"CVE-2026-112356","kind":"vulnerability","aliases":["CVE-2026-112356"],"related":[],"title":"Kerio Connect Webmail: crafted email injects script into victim's session","description":"GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.","summary":"Kerio Connect versions before 10.0.9 Patch 2 have a cross-site scripting flaw in Webmail's link auto-formatter, which re-processes text already inside a link. A remote attacker who sends a crafted email can break out of the href attribute and run script in the victim's authenticated Webmail session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","kerio-connect","package","self-hosted","webmail"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Kerio Connect version in the admin console or on the server; unknown if the sources give a exact command.\n- Confirm whether Webmail is in use by your users.","fix":"- Upgrade Kerio Connect to `10.0.9 Patch 2` or later.","status":"open","published_at":"2026-10-28T16:17:01+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:57+00:00","updated_at":"2026-10-28T16:35:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T16:35:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kerio Connect to `10.0.9 Patch 2` or later.","reach":"internet","title":"Kerio Connect Webmail: crafted email injects script into victim's session","impact":"medium","summary":"Kerio Connect versions before 10.0.9 Patch 2 have a cross-site scripting flaw in Webmail's link auto-formatter, which re-processes text already inside a link. A remote attacker who sends a crafted email can break out of the href attribute and run script in the victim's authenticated Webmail session.","category":"package","nicknames":[],"who_cares":["kerio-connect","self-hosted","email","webmail"],"confidence":0.6,"needs_auth":"no","worst_case":"script runs in victim's Webmail session, reading mail or actions","analyst_note":"","how_to_check":"- Check the installed Kerio Connect version in the admin console or on the server; unknown if the sources give a exact command.\n- Confirm whether Webmail is in use by your users.","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Teams running Kerio Connect with Webmail enabled, where users open mail in a browser, are exposed. The attack needs a victim to open the crafted message in Webmail, and the sources do not describe a default-off or special configuration. Installations on a version at or after 10.0.9 Patch 2 are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3414,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112356':14A,17A '-2026':13A,16A '10.0.9':31B,87C '2':33B,89C 'allow':102C 'alreadi':53B,133C,151C 'already-link':150C 'attack':59B,105C,137C,167C 'attacker-control':166C 'attribut':71B,163C 'authent':79B,122C 'auto':46B,143C 'auto-formatt':45B,142C 'break':66B,158C 'charact':156C 'compon':100C 'connect':2A,21B,28B,85C 'contain':90C 'control':168C 'craft':4A,63B,128C 'cross':37B,93C 'cross-sit':36B,92C 'cve':12A,15A 'email':5A,18B,64B,129C 'execut':171C 'exploit':139C 'flaw':40B 'formatt':47B,144C 'gfi':82C 'host':25B 'href':70B,162C 'html':112C 'inject':6A,111C,165C 'insid':54B,134C 'kerio':1A,20B,27B,84C 'kerio-connect':19B 'kerioconnect':83C 'link':44B,56B,108C,136C,141C,152C 'markup':169C 'messag':115C 'packag':22B 'patch':32B,88C 'process':51B,148C 'quot':155C 're':50B,147C 're-process':49B,146C 'remot':58B,104C 'render':117C 'run':73B 'script':7A,39B,74B,95C,172C 'self':24B 'self-host':23B 'send':61B,126C 'session':11A,81B,124C,177C 'site':38B,94C 'spoof':107C 'target':109C 'text':52B,131C,153C 'use':154C 'version':29B 'victim':9A,77B,120C,175C 'vulner':96C 'webmail':3A,26B,42B,80B,99C,123C 'whose':130C","nicknames":[],"mitigations":[],"who_affected":"Teams running Kerio Connect with Webmail enabled, where users open mail in a browser, are exposed. The attack needs a victim to open the crafted message in Webmail, and the sources do not describe a default-off or special configuration. Installations on a version at or after 10.0.9 Patch 2 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112356","severity":null,"published_at":"2026-10-28T16:17:01+00:00","modified_at":"2026-10-28T16:17:01+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}