Read the docs
TI-2026-82009 Aliases CVE-2026-112356GHSA-53x6-q8p5-wm6r

Cross-site scripting in GFI KerioConnect via link auto-formatter

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

GFI KerioConnect before 10.0.9 Patch 2 contains a cross-site scripting flaw in its Webmail component, where the link auto-formatter re-processes text that is already inside a link. A remote attacker can send a crafted email that uses quote characters to break out of the href attribute and inject markup that runs script in a victim's authenticated Webmail session. No privileges are required (PR:N). The flaw is tracked as CWE-79 and CWE-83.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed GFI KerioConnect (GFI USA, LLC): 10.0.9p2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GFI USA, LLCGFI KerioConnectbefore 10.0.9p210.0.9p2Patch availableCNA
  • GFI KerioConnect VendorGFI USA, LLC Affected before 10.0.9p2 Fixed in 10.0.9p2 Patch available CNA

Remediation

Update GFI KerioConnect to version 10.0.9p2 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA GFI KerioConnect (GFI USA, LLC) Fixed in 10.0.9p2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GFI KerioConnect 10.0.9p2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-82010 Privilege escalation in GFI KerioConnect KOFF via weak installer permissionsPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-112356
  2. 2026-10-28 CISA SSVC decision points changed
  3. 2026-10-28 Alias added: GHSA-53x6-q8p5-wm6r

References

Patch 1

  • TI-2026-82010 Privilege escalation in GFI KerioConnect KOFF via weak installer permissions CVSS 4.0HIGH 8.5
  • TI-2026-81415 Stored cross-site scripting in GFI KerioConnect Webmail CVSS 4.0MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences