Kerio Connect EUVD-2026-112138

The victim must read email using the Kerio Connect Webmail interface (the browser-based client whose auto-formatter re-processes link text); the attacker crafts an email whose link text contains quote characters so the formatter breaks out of the href attribute while re-processing text already inside a link. Attacker-side prerequisite is only the ability to send email to the victim (PR:N, no authentication to the target). Limiting factors: exploitation requires active user interaction (UI:A) - the victim must open the crafted message in Webmail - so users on desktop/IMAP clients that do not use this Webmail auto-formatter are not exposed, and impact is scoped to HTML injection/link spoofing within the victim's Webmail session rather than server-side compromise. Affected versions are Kerio Connect before 10.0.9 Patch 2.

This is a genuine but moderate-priority issue, not a high-severity emergency. The vendor-supplied CVSS 4.0 vector (5.1, Medium) is internally consistent with the description: AV:N (email delivered over the network), AC:L, AT:N, PR:N (any remote sender can craft the email without authentication to the target), but UI:A - active user interaction is required because a victim must open the crafted message in the Kerio Connect Webmail client before the auto-formatter mishandles the quoted link text. Impact is confined to the subsequent system (the victim's Webmail session: SC:L/SI:L) with no direct confidentiality, integrity or availability impact to the mail server itself (VC/VI/VA:N), matching an HTML-injection/link-spoofing flaw rather than server compromise. The priority decision label is 'this_month', not act_now or emergency. There is no CISA KEV listing (not actively exploited per CISA), no EPSS score was supplied, and no public exploit code is identified - only a VulnCheck advisory and a vendor release page are referenced. Weighing these signals together: the unauthenticated network-reachable vector is offset by the mandatory victim interaction and the limited, session-scoped impact, so this is a real but containable client-side injection issue appropriate for routine scheduled patching rather than out-of-band response. No key signals conflict; the main gap is the absence of EPSS data to gauge exploitation probability.

A remote attacker sends a victim an email containing a link whose visible link text includes quote characters. When the victim opens the message in Kerio Connect Webmail, the auto-formatter re-processes the already-linked text and breaks out of the href attribute, letting the attacker spoof the link's real destination or inject arbitrary HTML into the rendered message. No public exploit code is identified at time of analysis; a VulnCheck advisory describes the flaw.