Attackers are exploiting a stored cross-site scripting flaw in GFI KerioConnect Webmail, tracked as CVE-2026-112353, to steal credentials and mailbox contents, according to a CVE record that credits Proofpoint Threat Research. The fix has been available since November 2025, but the exploitation report is only now surfacing, and the flaw has not yet appeared in CISA’s Known Exploited Vulnerabilities catalog.
How a Crafted SVG Attachment Defeats Kerio Connect Sanitization
CVE-2026-112353 carries a CVSS score of 8.2 under version 3.1 and 6.2 under version 4. The flaw has two parts. A crafted SVG attachment bypasses the product’s sanitization of event-handler attributes, so script code survives inside the file. The temporary-download endpoint then applies an insufficient Content-Security-Policy sandbox, which lets that script run inside the victim’s logged-in webmail session.
Because the script executes with the user’s session, it can read what the user can read and send the results elsewhere. The attacker does not need an account on the Kerio server. The payload arrives by email, and opening the malicious attachment is the trigger.
What Proofpoint Observed in the Wild
The CVE record, published by VulnCheck, states that Proofpoint Threat Research observed exploitation in the wild, used as a credential and mailbox stealer. The record credits Proofpoint researchers Stu Del Caliz and Greg Lesnewich. Victim counts have not been published, and the record does not identify the attackers or describe the targeting.
Affected Versions and the Kerio Connect 10.0.8 Patch 2 Fix
GFI fixed the vulnerability in KerioConnect 10.0.8 Patch 2, released on November 28, 2025. Servers running an earlier build remain exposed. The gap between the patch date and the public exploitation report is nearly a year, which means any organization that has not updated in that span has been running a version with a known, fixable bug.
Response Steps for Kerio Connect Administrators
The recommended action is to upgrade to 10.0.8 Patch 2 or later. Administrators are also advised to warn users about unexpected SVG attachments and to review webmail sessions for signs of credential theft. Checking sessions matters because a stored-XSS stealer operates inside an authenticated session and may leave few traces on the server itself.
Why Webmail XSS Flaws Give Attackers Durable Access
The analysis of this class of bug points to a particular risk. A webmail session is often a gateway to far more than email: password resets for other services, shared calendars and attachments that contain internal documents all flow through the same mailbox. A script that runs in that session inherits all of it without needing to defeat a password check, and without triggering a failed-login alert.
The SVG format is a recurring choice for this kind of attack because it is an image type that can carry executable script, and filters designed around raster images may pass it through. Kerio’s case shows the defensive problem on both ends: sanitization has to catch every event-handler attribute, and the download sandbox has to contain whatever slips through. A weakness in either layer is enough, and here both were flawed.
The lack of a KEV listing does not indicate low risk. CISA’s catalog depends on its own evidence of exploitation and on vendor and researcher reports, and the record here comes from a CVE entry instead of a government advisory. If CISA adds the flaw, federal agencies would face a remediation deadline, but the more immediate exposure sits with private organizations that run Kerio Connect as their primary mail server and have not applied a patch that is nearly a year old.
The mechanics of the attack shape who is exposed. Since the payload is delivered by email and executes only when a user opens the message in the Kerio webmail client, exposure depends less on how the server is reachable from the internet and more on whether staff use the webmail interface. Each opened attachment hands the attacker whatever that session can see, including the full mailbox, which is why Proofpoint’s description of the tool as both a credential and a mailbox stealer fits the flaw’s design.
