CVE-2026-112356

16th percentile - higher than 16% of all known CVEs

GFI KerioConnect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

An attacker could execute arbitrary script in the context of the victim's session, potentially leading to credential theft, account takeover, or message content modification. The risk affects all Webmail users who open a crafted email.

Upgrade KerioConnect to version 10.0.9 Patch 2 or later. Inform users about the risk of opening suspicious emails and consider deploying additional anti-spam filters.