GFI KerioConnect CVE-2026-112357

Requires an existing local, non-administrative account on a Windows host where the GFI KerioConnect KOFF Outlook Connector (Offline Edition) prior to 10.0.9 Patch 2 is installed with its default/weak installer permissions, such that the product directory is writable by the built-in Users group. The attacker must be able to replace the searchd.exe binary used by the bundled KOFFIndexingService, which must be configured to run as LocalSystem. Code execution is triggered only on the next service start or reboot (no attacker-controlled immediate trigger is described). Limiting factors: no network vector (local access is a prerequisite), the vulnerable KOFF component must be installed, and installations already upgraded to 10.0.9 Patch 2 or with corrected directory ACLs are not exploitable.

This is a genuine, prioritizable local privilege escalation (CWE-276, incorrect default permissions), but it is not a remote or wormable threat. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: exploitation requires a local, already-authenticated low-privileged foothold, needs no user interaction and no special timing (AT:N/AC:L), and yields full compromise (SYSTEM) of the host. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no signal of active or widespread exploitation; EPSS absence plus KEV absence means exploitation probability cannot be quantified here. No SSVC decision tree values were provided - only a vendor-aggregator priority label of 'this_week', which is consistent with a reliably exploitable but access-gated flaw rather than an emergency. The realistic priority driver is that exploitation is deterministic and low-complexity once local access exists (post-compromise escalation, insider, or chained from another bug), with high technical impact. Treat it as an important patch on this_week cadence for hosts running KOFF, not a drop-everything internet-facing emergency.

A non-administrative user (or malware running in a standard user context) on a Windows host with the KOFF Outlook Connector installed overwrites the searchd.exe binary inside the product directory, which is writable by the built-in Users group. The next time the KOFFIndexingService (running as LocalSystem) starts - on service restart or reboot - the planted binary executes with NT AUTHORITY\SYSTEM privileges. Exploitation is low-complexity local (AV:L/AC:L) and needs no user interaction, though it does require an existing low-privileged account on the machine.