# CVE-2026-112353: GFI KerioConnect stored XSS in Webmail via SVG attachment

Source: https://junglewise.ai/threats/cve-2026-112353-gfi-kerioconnect-kerio-connect-before-10-0-8-patch-2-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-112353 · Severity: high · CVSS 8.2 · Published 2026-10-27

GFI KerioConnect is an email and collaboration server used by organizations for messaging and calendar services. The Webmail component contains a stored cross-site scripting flaw that allows remote attackers to run malicious JavaScript by uploading a crafted SVG email attachment, potentially stealing user credentials and complete mailbox contents when the victim opens the attachment.

Vendors: [GFI](https://junglewise.ai/threats/vendors/gfi).

## Quick answers

**Is CVE-2026-112353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112353 being exploited in the wild.

**How severe is CVE-2026-112353?** High severity, with a CVSS score of 8.2, published 27 October 2026.

**Which products and versions are affected?** GFI KerioConnect before 10.0.8 Patch 2.

**Is there a fix for CVE-2026-112353?** Yes: fixed in 10.0.8 Patch 2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112353 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112353?** Check whether you run GFI KerioConnect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.8 Patch 2

## Technical details

A stored XSS vulnerability in the Webmail component allows remote attackers to bypass SVG event-handler attribute sanitization and execute JavaScript in an authenticated user's session. The temporary-download endpoint lacks sufficient Content-Security-Policy sandbox protection, enabling script execution when crafted email attachments are opened. This grants attackers access to session credentials and mailbox data.

## Affected products

- GFI KerioConnect before 10.0.8 Patch 2

## Timeline

- 2026-10-27: disclosed
- 2026-10-27: exploited: Proofpoint Threat Research observed exploitation in the wild as credential and mailbox stealer
- 2025-11-28: patched: Fix released in 10.0.8p2

## References

- [https://gfi.ai/resource/kerioconnect-product-releases/](https://gfi.ai/resource/kerioconnect-product-releases/)
- [https://www.vulncheck.com/advisories/gfi-kerioconnect-8p2-stored-xss-via-svg-attachment](https://www.vulncheck.com/advisories/gfi-kerioconnect-8p2-stored-xss-via-svg-attachment)

## Related threats

- [GFI KerioConnect Webmail cross-site scripting via link auto-formatter](https://junglewise.ai/threats/cve-2026-112356-gfi-kerioconnect-kerio-connect-before-10-0-9-patch-2-contains-a)