Read the docs
TI-2026-76244 Aliases CVE-2026-108121GHSA-2pfr-4hx7-3p8p

Koozali SME Server domain creation flaw enables denial of service

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Koozali SME Server from version 11.0rc1-215 is affected by improper input validation (CWE-20) in its domain creation functionality. An attacker with high privileges can inject reserved Apache configuration directives that corrupt httpd.conf. Apache then fails to start after a server reboot, denying service to the web server and its hosted virtual hosts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KoozaliSME Server11.0rc1-215—No fix listedCNA
  • SME Server VendorKoozali Affected 11.0rc1-215 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Koozali SME Server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-108121
  2. 2026-10-19 Alias added: GHSA-2pfr-4hx7-3p8p
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-76243 Path traversal in Koozali SME Server View Logs exposes files CVSS 4.0HIGH 7.7
  • TI-2017-14373 Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences