CVE-2026-112356
GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
| CWE | CWE-79 CWE-83 |
| Vendor | gfi usa, llc |
| Product | gfi kerioconnect |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for gfi usa, llc gfi kerioconnect
Be the first to know when new medium vulnerabilities affecting gfi usa, llc gfi kerioconnect are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
GFI USA, LLC / GFI KerioConnect
0 < 10.0.9p2
References
Credits
Justin Verrier