GFI KerioConnect CVE-2026-112353

Exploitation requires an attacker to deliver a crafted SVG email attachment to a Kerio Connect user and the victim to open that attachment within the Webmail component; the SVG must bypass sanitization of event-handler attributes, and the temporary-download endpoint's insufficient Content-Security-Policy sandbox must permit script execution. The affected component is the default Webmail feature of Kerio Connect versions before 10.0.8 Patch 2, so no special non-default configuration is described as required. Limiting factors that reduce realistic risk: the victim must take active action (opening the attachment, UI:A), the victim must already hold an authenticated Webmail session for credential/mailbox theft to be meaningful, and only versions prior to 10.0.8 Patch 2 are affected - patched instances are not exploitable.

The supplied CVSS 4.0 base score is 6.2 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N: network-reachable, low complexity, no attacker privileges, but requiring active victim interaction (UI:A) and producing impact only on a subsequent system (SC:H/SI:L) - the victim's authenticated browser/Webmail session - rather than the mail server itself (VC/VI/VA:N). This is the classic signature of a stored XSS: the server is intact but the user's session is fully compromised. The signals partly conflict: the description states Proofpoint Threat Research has observed in-the-wild use as a credential/mailbox stealer, which would normally push urgency high, yet there is no CISA KEV entry in the provided data, no EPSS score, and the vuln.today Decision label is only 'this_month' (not act_now/emergency). The requirement for the victim to open a malicious attachment (UI:A) limits spray-and-pray mass exploitation and favors targeted phishing-style delivery, which is consistent with a medium score alongside a threat-research sighting. Net: treat as a real, actively-abused priority worth patching within the vendor/priority window, but the medium CVSS and the user-interaction gate mean it is not a wormable, unauthenticated-RCE-class emergency. Note explicitly: active exploitation is claimed by Proofpoint in the description but is NOT corroborated by a CISA KEV field in the input, and no EPSS value was provided - verify KEV/EPSS independently before escalating beyond the 'this_month' label.

A remote attacker with no account emails a crafted SVG file as an attachment to a Kerio Connect Webmail user. When the victim opens the attachment, a sanitization bypass of SVG event-handler attributes combined with the temporary-download endpoint's insufficient Content-Security-Policy sandbox causes embedded JavaScript to execute inside the victim's authenticated Webmail session, allowing theft of credentials and mailbox contents. Proofpoint Threat Research reports this technique is being used in the wild as a credential and mailbox stealer, and VulnCheck has published an advisory, though no verified working exploit code is confirmed in the provided data.