{"id":"CVE-2026-112357","kind":"vulnerability","aliases":["CVE-2026-112357"],"related":[],"title":"Kerio Connect Outlook Connector: local users can gain SYSTEM privileges","description":"GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\\SYSTEM privileges upon the next service start or reboot.","summary":"The Kerio Connect Outlook Connector (Offline Edition) installs its product directory writable by the built-in Users group. A local non-admin user can replace the searchd.exe binary run by the KOFFIndexingService, which runs as LocalSystem, and gain SYSTEM rights on the next service start or reboot.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kerio-connect","other","outlook-connector","windows"],"not_affected_if":["koff-not-installed","patched-build"],"how_to_check":"- Check the installed version of KOFF (Kerio Connect Outlook Connector Offline Edition) in Programs and Features; affected builds are before `10.0.9 Patch 2`\n- Check whether the Users group has write permission on the KOFF install directory, e.g. `icacls \"<KOFF install path>\"`\n- Confirm the KOFFIndexingService service exists with `sc qc KOFFIndexingService`","fix":"- Update the KOFF Outlook Connector to `10.0.9 Patch 2` or later\n- Until patched, remove write permissions for the Users group on the KOFF install directory","status":"open","published_at":"2026-10-28T16:17:01+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:45+00:00","updated_at":"2026-10-28T16:35:45+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-28T16:35:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update the KOFF Outlook Connector to `10.0.9 Patch 2` or later\n- Until patched, remove write permissions for the Users group on the KOFF install directory","reach":"local","title":"Kerio Connect Outlook Connector: local users can gain SYSTEM privileges","impact":"high","summary":"The Kerio Connect Outlook Connector (Offline Edition) installs its product directory writable by the built-in Users group. A local non-admin user can replace the searchd.exe binary run by the KOFFIndexingService, which runs as LocalSystem, and gain SYSTEM rights on the next service start or reboot.","category":"other","nicknames":[],"who_cares":["windows","kerio-connect","outlook-connector"],"confidence":0.8,"needs_auth":"yes","worst_case":"local user runs code as SYSTEM on the machine","analyst_note":"","how_to_check":"- Check the installed version of KOFF (Kerio Connect Outlook Connector Offline Edition) in Programs and Features; affected builds are before `10.0.9 Patch 2`\n- Check whether the Users group has write permission on the KOFF install directory, e.g. `icacls \"<KOFF install path>\"`\n- Confirm the KOFFIndexingService service exists with `sc qc KOFFIndexingService`","needs_analyst":false,"not_affected_if":["koff-not-installed","patched-build"],"who_is_affected":"Windows machines where the Kerio Connect Outlook Connector (Offline Edition) is installed below 10.0.9 Patch 2. Any local, non-admin user on such a machine can exploit it, so shared or multi-user workstations and terminal servers are the most exposed. Machines without KOFF installed, or already on the patched build, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":3425,"output_tokens":649,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112357':13A,16A '-2026':12A,15A '10.0.9':84C '2':86C 'admin':48B 'administr':115C 'arbitrari':134C 'attack':116C 'author':138C 'binari':54B,122C 'built':40B,107C 'built-in':39B,106C 'bundl':126C 'caus':93C 'code':135C 'connect':2A,19B,27B,77C 'connector':4A,23B,29B,79C 'contain':87C 'cve':11A,14A 'directori':35B,102C 'edit':31B,81C 'escal':91C 'execut':133C 'gain':8A,64B 'gfi':74C 'group':43B,110C 'instal':32B,96C 'kerio':1A,18B,26B,76C 'kerio-connect':17B 'kerioconnect':75C 'koff':82C 'koffindexingservic':58B,127C 'leav':99C 'local':5A,45B,89C,112C 'localsystem':62B,131C 'next':69B,143C 'non':47B,114C 'non-admin':46B 'non-administr':113C 'nt':137C 'offlin':30B,80C 'outlook':3A,22B,28B,78C 'outlook-connector':21B 'patch':85C 'permiss':97C 'privileg':10A,90C,140C 'product':34B,101C 'reboot':73B,147C 'replac':51B,118C 'right':66B 'run':55B,60B,129C 'searchd.exe':53B,120C 'servic':70B,121C,144C 'start':71B,145C 'system':9A,65B,139C 'upon':141C 'use':123C 'user':6A,42B,49B,109C 'vulner':92C 'weak':95C 'window':24B 'writabl':36B,103C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where the Kerio Connect Outlook Connector (Offline Edition) is installed below 10.0.9 Patch 2. Any local, non-admin user on such a machine can exploit it, so shared or multi-user workstations and terminal servers are the most exposed. Machines without KOFF installed, or already on the patched build, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112357","severity":null,"published_at":"2026-10-28T16:17:01+00:00","modified_at":"2026-10-28T16:17:01+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}