CVE-2026-112356 - GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail comp
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
MEDIUM
Severity & confidence
Source severitymedium
Platform severitymedium
Confidencehigh
Exploitationunknown
CVSS6.1
Affected
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-28T16:17:01
Last updated2026-10-31T16:05:39
Ingested2026-10-31T04:48:49
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database
