Is CVE-2026-112356 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112356 being exploited in the wild.

How severe is CVE-2026-112356?

Medium severity, with a CVSS score of 6.1, published 28 October 2026.

Which products and versions are affected?

GFI KerioConnect before 10.0.9 Patch 2.

Is there a fix for CVE-2026-112356?

Yes: fixed in 10.0.9 Patch 2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112356 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112356?

Check whether you run GFI KerioConnect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112356: GFI KerioConnect Webmail cross-site scripting via link auto-formatter

CVE-2026-112356 · Severity: medium · CVSS 6.1 · Published 2026-10-28

GFI KerioConnect is an email and collaboration server used by organizations for messaging and calendar services. A cross-site scripting vulnerability in the Webmail component allows an attacker to inject malicious scripts into emails by exploiting how the system automatically formats links. When a victim opens a crafted email in Webmail, the attacker's script executes in the victim's authenticated session, potentially allowing account takeover, credential theft, or unauthorized actions on behalf of the user.

Vendors: GFI.

Quick answers

Is CVE-2026-112356 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112356 being exploited in the wild.
How severe is CVE-2026-112356?: Medium severity, with a CVSS score of 6.1, published 28 October 2026.
Which products and versions are affected?: GFI KerioConnect before 10.0.9 Patch 2.
Is there a fix for CVE-2026-112356?: Yes: fixed in 10.0.9 Patch 2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112356 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112356?: Check whether you run GFI KerioConnect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.0.9 Patch 2

Technical details

The vulnerability exists in the Webmail link auto-formatter, which fails to properly sanitize markup when re-processing text that is already contained within anchor tags. An attacker can craft an email with nested anchor tags using quote characters to break out of the href attribute and inject arbitrary HTML and JavaScript. This requires the victim to be authenticated and open the malicious email in Webmail, but no additional user interaction is needed beyond viewing the message.

Affected products

GFI KerioConnect before 10.0.9 Patch 2

Timeline

2026-10-28: disclosed
2026-06-29: patched: Fixed in 10.0.9p2 released June 29, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.