Live › vulnerability › CVE-2026-112357
Go to dashboardThe Kerio Connect Outlook Connector (Offline Edition) installs its product directory writable by the built-in Users group. A local non-admin user can replace the searchd.exe binary run by the KOFFIndexingService, which runs as LocalSystem, and gain SYSTEM rights on the next service start or reboot.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Windows machines where the Kerio Connect Outlook Connector (Offline Edition) is installed below 10.0.9 Patch 2. Any local, non-admin user on such a machine can exploit it, so shared or multi-user workstations and terminal servers are the most exposed. Machines without KOFF installed, or already on the patched build, are not affected.
No product ranges from the sources yet.
10.0.9 Patch 2icacls "<KOFF install path>"sc qc KOFFIndexingService10.0.9 Patch 2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.
This page as .md · .json · in your agent: get_signal("CVE-2026-112357")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.